Sandworm Team (G0034) | Threat Actor Index

79

Techniques

27

Toolsets

2

CVEs Referenced

1

KEV Entries

CISA Known Exploited

About Sandworm Team

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455. This group has been active since at least 2009. In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019. Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.

View MITRE record ↗

Techniques by Tactic (79)

Reconnaissance

T1589.002 Email AddressesT1589.003 Employee NamesT1590.001 Domain PropertiesT1591.002 Business RelationshipsT1592.002 SoftwareT1593 Search Open Websites/DomainsT1594 Search Victim-Owned WebsitesT1595.002 Vulnerability ScanningT1598.003 Spearphishing Link

Resource Development

T1583 Acquire InfrastructureT1583.001 DomainsT1583.004 ServerT1584.004 ServerT1584.005 BotnetT1585.001 Social Media AccountsT1585.002 Email AccountsT1586.001 Social Media AccountsT1587.001 MalwareT1588.002 ToolT1588.006 VulnerabilitiesT1608.001 Upload Malware

Initial Access

T1078 Valid AccountsT1078.002 Domain AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1195.002 Compromise Software Supply ChainT1199 Trusted RelationshipT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.005 Visual BasicT1072 Software Deployment ToolsT1106 Native APIT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious File

Persistence

T1053.005 Scheduled TaskT1078 Valid AccountsT1078.002 Domain AccountsT1133 External Remote ServicesT1505.003 Web Shell

Privilege Escalation

T1053.005 Scheduled TaskT1078 Valid AccountsT1078.002 Domain Accounts

Stealth

T1027 Obfuscated Files or InformationT1027.010 Command ObfuscationT1036 MasqueradingT1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1078 Valid AccountsT1078.002 Domain AccountsT1140 Deobfuscate/Decode Files or InformationT1218.011 Rundll32

Credential Access

T1003.001 LSASS MemoryT1003.003 NTDST1040 Network SniffingT1056.001 KeyloggingT1539 Steal Web Session CookieT1555.003 Credentials from Web Browsers

Discovery

T1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1040 Network SniffingT1049 System Network Connections DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.002 Domain AccountT1087.003 Email Account

Lateral Movement

T1021.002 SMB/Windows Admin SharesT1072 Software Deployment ToolsT1570 Lateral Tool Transfer

Collection

T1005 Data from Local SystemT1056.001 KeyloggingT1213.006 Databases

Command & Control

T1071.001 Web ProtocolsT1090 ProxyT1102.002 Bidirectional CommunicationT1105 Ingress Tool TransferT1132.001 Standard EncodingT1219 Remote Access ToolsT1571 Non-Standard Port

Exfiltration

T1041 Exfiltration Over C2 Channel

Impact

T1485 Data DestructionT1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System RecoveryT1491.002 External DefacementT1499 Endpoint Denial of ServiceT1561.002 Disk Structure Wipe

Toolsets (27)

🐛

AcidPour S1167

Malware · Linux

🐛

AcidRain S1125

Malware · Network Devices, Linux

🐛

Bad Rabbit S0606

Malware · Windows

🐛

BlackEnergy S0089

Malware · Windows

🐛

Cobalt Strike S0154

Malware · Linux, macOS, Windows

🐛

Cyclops Blink S0687

Malware · Network Devices

🐛

Exaramel for Linux S0401

Malware · Linux

🐛

Exaramel for Windows S0343

Malware · Windows

🐛

GreyEnergy S0342

Malware · Windows

🐛

Industroyer S0604

Malware · Windows

🐛

Industroyer2 S1072

Malware · Field Controller/RTU/PLC/IED, Engineering Workstation

🐛

Kapeka S1190

Malware · Windows

🐛

KillDisk S0607

Malware · Linux, Windows

🐛

Neo-reGeorg S1189

Malware · Network Devices, Windows, macOS, Linux

🐛

NotPetya S0368

Malware · Windows

🐛

Olympic Destroyer S0365

Malware · Windows

🐛

P.A.S. Webshell S0598

Malware · Linux, Windows

🐛

Prestige S1058

Malware · Windows

🐛

VPNFilter S1010

Malware · Network Devices, Linux

🔧

Empire S0363

Tool · Linux, macOS, Windows

🔧

Impacket S0357

Tool · Linux, macOS, Windows

🔧

Invoke-PSImage S0231

Tool

🔧

Mimikatz S0002

Tool · Windows

🔧

Net S0039

Tool · Windows

🔧

PoshC2 S0378

Tool · Windows, Linux, macOS

🔧

PsExec S0029

Tool · Windows

🔧

SDelete S0195

Tool · Windows

CVEs Referenced (2 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

References & Reports (15)

↑