MITRE ATT&CKcampaign

C0034 2022 Ukraine Electric Power Attack

Published 2024-03-27 Modified 2026-07-31 Official page ↗
Domain
enterprise, ics
Version
1.0
Created
2024-03-27

Description

The 2022 Ukraine Electric Power Attack was a Sandworm Team campaign that used a combination of GOGETTER, Neo-REGEORG, CaddyWiper, and living of the land (LotL) techniques to gain access to a Ukrainian electric utility to send unauthorized commands from their SCADA system.

Related

Attributed to · MITRE ATT&CK (1)

  • G0034 Sandworm Team group

Uses · MITRE ATT&CK (16)

  • T1701.002 Windows Command Shell sub-technique
  • T1701.004 Visual Basic sub-technique
  • T1692.001 Command Message sub-technique
  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • S0693 CaddyWiper software (malware)
  • T1484.001 Group Policy Modification sub-technique
  • T1572 Protocol Tunneling technique
  • T1570 Lateral Tool Transfer technique
  • T1059.001 PowerShell sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1543.002 Systemd Service sub-technique
  • T1505.003 Web Shell sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1485 Data Destruction technique
  • T1095 Non-Application Layer Protocol technique

References