MITRE ATT&CKgroup

G0034 Sandworm Team

Published 2017-05-31 Modified 2026-07-31 Official page ↗
Domain
enterprise, ics, mobile
Aliases
ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group), Quedagh, Voodoo Bear, IRIDIUM, Seashell Blizzard, FROZENBARENTS, APT44
Version
4.2
Created
2017-05-31

Description

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455. This group has been active since at least 2009. In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019. Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.

Related

Uses · MITRE ATT&CK (114)

  • T1701.001 PowerShell sub-technique
  • T1701.002 Windows Command Shell sub-technique
  • T1213.006 Databases sub-technique
  • T1676 Linked Devices technique
  • S1189 Neo-reGeorg software (malware)
  • S1190 Kapeka software (malware)
  • S1167 AcidPour software (malware)
  • S1125 AcidRain software (malware)
  • T1660 Phishing technique
  • S1072 Industroyer2 software (malware)
  • T1027.010 Command Obfuscation sub-technique
  • S1058 Prestige software (malware)
  • S0687 Cyclops Blink software (malware)
  • S0598 P.A.S. Webshell software (malware)
  • T1608.001 Upload Malware sub-technique
  • S0606 Bad Rabbit software (malware)
  • S0607 KillDisk software (malware)
  • S0604 Industroyer software (malware)
  • S0555 CHEMISTGAMES software (malware)
  • T1588.006 Vulnerabilities sub-technique
  • T1589.002 Email Addresses sub-technique
  • T1589.003 Employee Names sub-technique
  • T1590.001 Domain Properties sub-technique
  • T1591.002 Business Relationships sub-technique
  • T1592.002 Software sub-technique
  • T1593 Search Open Websites/Domains technique
  • T1594 Search Victim-Owned Websites technique
  • T1595.002 Vulnerability Scanning sub-technique
  • T1598.003 Spearphishing Link sub-technique
  • T1583.004 Server sub-technique
Show all 114 ›

Referenced by MITRE ATT&CK · attributed to (3)

  • C0034 2022 Ukraine Electric Power Attack campaign
  • C0028 2015 Ukraine Electric Power Attack campaign
  • C0025 2016 Ukraine Electric Power Attack campaign

References