We assess that a destructive mandate has likely been assigned to at least Sandworm, TEMP.Isotope, and possibly UNC2589. We judge that although APT29 likely has the technical proficiency to create their own disruptive malware or the potential to purchase this malware from contract development teams such as those included in the SolarWinds sanctions, they likely do not have a disruptive or destructive mandate as they have not been observed conducting these operations or targeting critical infrastructure in preparation for disruptive or destructive activity.