tokens: Like BlackEnergy, the malware used by the so-called Sandworm APT group also known as Quedagh, Potao is an example of targeted espionage malware directed mostly at targets in Ukraine and a number of other post-Soviet countries, including Russia, Georgia and Belarus.