MITRE ATT&CKcampaign

C0025 2016 Ukraine Electric Power Attack

Published 2023-03-31 Modified 2026-07-31 Official page ↗
Domain
enterprise, ics
Version
1.0
Created
2023-03-31

Description

2016 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used Industroyer malware to target and disrupt distribution substations within the Ukrainian power grid. This campaign was the second major public attack conducted against Ukraine by Sandworm Team.

Related

Attributed to · MITRE ATT&CK (1)

  • G0034 Sandworm Team group

Uses · MITRE ATT&CK (29)

  • T1701.001 PowerShell sub-technique
  • T1701.002 Windows Command Shell sub-technique
  • T1701.004 Visual Basic sub-technique
  • T1685.001 Disable or Modify Windows Event Log sub-technique
  • T1036.010 Masquerade Account Name sub-technique
  • T1036.008 Masquerade File Type sub-technique
  • T0886 Remote Services technique
  • S0604 Industroyer software (malware)
  • T0849 Masquerading technique
  • T0859 Valid Accounts technique
  • T0867 Lateral Tool Transfer technique
  • T1570 Lateral Tool Transfer technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1554 Compromise Host Software Binary technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1027.002 Software Packing sub-technique
  • T1136.002 Domain Account sub-technique
  • T1543.003 Windows Service sub-technique
  • T1505.001 SQL Stored Procedures sub-technique
  • T1136 Create Account technique
  • T1018 Remote System Discovery technique
  • T1027 Obfuscated Files or Information technique
  • T1047 Windows Management Instrumentation technique
  • T1098 Account Manipulation technique
  • T1110 Brute Force technique

References