“At one point, an error on APT44’s part resulted in Cyber Army of Russia Reborn claiming on their channel an attack that APT44 had not yet carried out.”
The “hacktivists” posted their hack before the GRU had done it. Mandiant ties three Telegram channels to Sandworm, and Google found the Cyber Army of Russia Reborn YouTube channel was built on Sandworm infrastructure. The group claimed attacks on water utilities in the US and Poland, and US officials confirmed incidents and malfunctions. The volunteer patriots are a military intelligence unit with a branding department.