Tactics: Why LotL?
Sandworm "Lives off the Land" using libraries already present in target environment’s OS (e.g., cmd.exe, powershell.exe, wmic.exe, certutil.exe) — it looks like a routine update.
It creates #PlausibleDeniability
By the time it’s IDd, "DynoWiper" already been staged for execution