The Russian threat group Sandworm was observed destroying data on Ukrainian state networks using a malicious script, RoarBat. Sandworm gained initial access to the networks by compromising VPN accounts that lacked two-factor authentication.