- Performance: Mark Bramhall's restrained, unhurried delivery is exactly right for this investigative reporting.
- What it covers: State-sponsored hacking, cyberwarfare, geopolitical espionage
- Feel: Tense but controlled, never sensationalized
- Our call: A genre-best pick for anyone who wants cybersecurity nonfiction that reads like a thriller.
Andy Greenberg's Sandworm is the rare cybersecurity book that reads like a geopolitical thriller without inventing a single dramatic flourish, and the verdict on this audiobook is immediate: Mark Bramhall's restrained, unhurried narration is exactly the register this kind of reporting deserves.
No synopsis accompanies this specific listing, so what follows draws on the book's well-documented real content. Greenberg, a senior writer at Wired, spent years tracing a Russian military intelligence hacking unit responsible for some of the most destructive cyberattacks in history, including the 2015 and 2016 attacks that caused the first confirmed blackouts ever triggered by a cyberattack in Ukraine, and the 2017 NotPetya malware, which caused billions of dollars in global damage to companies including Maersk and Merck within a matter of hours.
Named After Dune, Causing Very Real Damage
What makes this book land as genuine narrative nonfiction rather than a technical briefing is Greenberg's insistence on following the human researchers, at security firms, at Ukrainian utilities, inside American intelligence agencies, who slowly pieced together who was actually behind these attacks and why. The technical detail is real and specific, but it never overwhelms the reporting's actual structure, which is closer to an investigative thriller than a systems-administration manual.
The NotPetya sections carry particular weight, since Greenberg traces how a piece of malware aimed initially at Ukraine spread uncontrolled across the entire globe within hours, hitting companies with no connection to the original target at all. That escalation, a weapon designed for one specific geopolitical conflict causing worldwide collateral damage almost immediately, is the book's most unsettling and most memorable through-line.
Greenberg built his reporting reputation at Wired covering hackers, cryptography, and digital crime more broadly before turning his full attention to this specific investigation, and that background shows in how comfortably he moves between highly technical forensic detail and the broader geopolitical stakes surrounding it. He treats both registers as equally important to the story rather than treating the technical material as a necessary chore before getting to the more compelling human drama.
The book's title itself comes from the hacking group's own chosen code name, apparently a reference to the Dune novels, and Greenberg treats that detail as revealing, a deliberately mythic, almost theatrical self-branding choice from a group whose actual work caused very real, very unmythical economic damage. Ukraine's role in this story extends beyond being merely a testing ground too; Greenberg frames the country as an unwilling frontline laboratory where a state actor rehearsed techniques before some of the same tools and tactics showed up affecting targets elsewhere.
Bramhall Handles ICS, SCADA and APT Cleanly
Mark Bramhall's narration here fits a specific, demanding brief precisely: a restrained-concern register that takes genuinely alarming material seriously without ever tipping into sensationalism, plus clean, confident handling of dense technical acronyms, ICS, SCADA, APT, that could easily trip up a less prepared narrator across a twelve-hour runtime. That combination of steadiness and technical fluency honors Greenberg's own reporting voice rather than working against it.
At just over twelve hours, the runtime matches the genuine scope of years of investigative reporting across multiple countries and dozens of named sources, without feeling padded the way some true-crime-adjacent nonfiction can when stretched past its natural length.
The book received serious critical attention on publication, treated by reviewers as a genuine contribution to understanding modern cyberwarfare rather than just a well-written technology story, and that reputation has only grown as the specific attacks it documents, particularly the Ukraine grid attacks, have taken on new relevance amid the broader Russia-Ukraine conflict that escalated dramatically in the years since publication.
Greenberg also gives real space to the researchers themselves as characters, not just sources, tracking specific individuals across years of their careers as they became increasingly consumed by tracking this one group's activity. That choice makes the book's back half feel more personal than a typical technology-reporting title, closer to character-driven narrative nonfiction than a chronological incident log.
Accessible Without Any Cybersecurity Background
This listing arrives with an empty synopsis field, so real value exists in knowing upfront that the underlying book is both well-reviewed and well-sourced rather than an obscure or unverified title.
The computers-technology genre tag and Security & Encryption category are both accurate, but they may undersell how accessible this actually is to a general nonfiction audience. You don't need an IT background to follow the reporting, since Greenberg explains technical concepts as he introduces them rather than assuming prior expertise.
Worth knowing going in: this book focuses specifically on one hacking unit and its documented campaigns rather than attempting a comprehensive survey of state-sponsored cyberwarfare generally. Listeners wanting broader context on other nations' state-sponsored hacking operations will need separate titles to cover that wider landscape; Greenberg stays disciplined about his specific subject throughout.
Proving Attribution Without a Smoking Gun
A recurring thread throughout the book is the genuine difficulty of attribution in cybersecurity; proving definitively who is behind an anonymous digital attack routed through multiple countries and false-flag misdirection is notoriously hard, and Greenberg spends real time showing how independent researchers, private security firms, and government agencies slowly built converging lines of evidence rather than relying on any single smoking-gun proof.
Listeners who found Countdown to Zero Day's pacing too slow should know Sandworm moves at a noticeably brisker clip, favoring propulsive chapter-length reveals over exhaustive technical explanation, a structural choice that keeps the book's momentum closer to narrative nonfiction than to a security-industry deep dive.
Skip It If You Want a Technical Manual
This suits investigative journalism fans, cybersecurity professionals wanting the human story behind attacks they may already know technically, and listeners of similar tech-thriller nonfiction like Kim Zetter's Countdown to Zero Day, which covers adjacent territory in the same broader genre of state-sponsored cyberwarfare reporting.
It also rewards listeners with any personal or professional connection to critical infrastructure, utilities, logistics, and shipping among them, since the book's central argument, that civilian infrastructure is now a legitimate target in state conflicts, has direct practical stakes for anyone working in those sectors. It also suits listeners generally interested in modern journalism craft, since Greenberg's reporting process itself, years of cultivating sources across multiple countries and disciplines, is as instructive as the finished narrative it produced, and rewards anyone who enjoys books that connect a specific, well-documented incident to much larger geopolitical stakes.
Skip it if you want a hands-on technical security guide rather than narrative journalism, since this stays focused on reporting and consequence rather than defensive how-to instruction. Skip it too if geopolitical tension and real-world stakes make for stressful rather than engaging listening for you personally, since the book doesn't soften the genuine severity of what it's documenting.
