Sandworm Team

Introduction

Sandworm Team is a destructive threat group that has been attributed to Russia’s General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455. US District Court Indictment GRU Unit 74455 October 2020 UK NCSC Olympic Attacks October 2020 This group has been active since at least 2009. iSIGHT Sandworm 2014 CrowdStrike VOODOO BEAR USDOJ Sandworm Feb 2020 NCSC Sandworm Feb 2020 In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019. US District Court Indictment GRU Unit 74455 October 2020 UK NCSC Olympic Attacks October 2020 Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28. US District Court Indictment GRU Oct 2018

Activities and Tactics

Targeted Sectors: Electric, Energy, Industrial, Private sector, Government

Country of Origin: 🇷🇺 Russia

First Seen: 2014

Last Activity: 2015

Incident Type: Espionage

Suspected Victims: Russia, Lithuania, Kyrgyzstan, Israel, Ukraine, Belarus, Kazakhstan, Georgia, Poland, Azerbaijan…

Notable Campaigns

• 2015 Ukraine Electric Power Attack (C0028): 2015 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used BlackEnergy (specifically BlackEnergy3) and KillDisk to target and disrupt transmission and distribution substations within the Ukrainian power grid. This campaign was the first major public attack conducted against the Ukrainian power grid by Sandworm Team.
• 2016 Ukraine Electric Power Attack (C0025): 2016 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used Industroyer malware to target and disrupt distribution substations within the Ukrainian power grid. This campaign was the second major public attack conducted against Ukraine by Sandworm Team.(Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)
• 2022 Ukraine Electric Power Attack (C0034): The 2022 Ukraine Electric Power Attack was a Sandworm Team campaign that used a combination of GOGETTER, Neo-REGEORG, CaddyWiper, and living of the land (LotL) techniques to gain access to a Ukrainian electric utility to send unauthorized commands from their SCADA system.(Citation: Mandiant-Sandworm-Ukraine-2022)(Citation: Dragos-Sandworm-Ukraine-2022)

Tactics, Techniques, and Procedures (TTPs)

• T1608.001 Upload Malware
• T1588.006 Vulnerabilities
• T1040 Network Sniffing
• T1027.010 Command Obfuscation
• T1595.002 Vulnerability Scanning
• T1585.001 Social Media Accounts
• T1586.001 Social Media Accounts
• T1132.001 Standard Encoding
• T1213.006 Databases
• T1539 Steal Web Session Cookie
• T1059.001 PowerShell
• T1090 Proxy
• T1203 Exploitation for Client Execution
• T1041 Exfiltration Over C2 Channel
• T1053.005 Scheduled Task
• T1190 Exploit Public-Facing Application
• T1078.002 Domain Accounts
• T1003.003 NTDS
• T1036 Masquerading
• T1598.003 Spearphishing Link
• T1133 External Remote Services
• T1587.001 Malware
• T1072 Software Deployment Tools
• T1584.005 Botnet
• T1566.002 Spearphishing Link
• T1018 Remote System Discovery
• T1589.003 Employee Names
• T1078 Valid Accounts
• T1566.001 Spearphishing Attachment
• T1204.002 Malicious File
• T1106 Native API
• T1588.002 Tool
• T1583.004 Server
• T1590.001 Domain Properties
• T1083 File and Directory Discovery
• T1049 System Network Connections Discovery
• T1555.003 Credentials from Web Browsers
• T1489 Service Stop
• T1571 Non-Standard Port
• T1070.004 File Deletion
• T1047 Windows Management Instrumentation
• T1087.003 Email Account
• T1021.002 SMB/Windows Admin Shares
• T1204.001 Malicious Link
• T1505.003 Web Shell
• T1218.011 Rundll32
• T1499 Endpoint Denial of Service
• T1195.002 Compromise Software Supply Chain
• T1199 Trusted Relationship
• T1056.001 Keylogging
• T1561.002 Disk Structure Wipe
• T1486 Data Encrypted for Impact
• T1592.002 Software
• T1491.002 External Defacement
• T1583 Acquire Infrastructure
• T1219 Remote Access Tools
• T1584.004 Server
• T1003.001 LSASS Memory
• T1594 Search Victim-Owned Websites
• T1570 Lateral Tool Transfer
• T1027 Obfuscated Files or Information
• T1591.002 Business Relationships
• T1585.002 Email Accounts
• T1102.002 Bidirectional Communication
• T1490 Inhibit System Recovery
• T1583.001 Domains
• T1140 Deobfuscate/Decode Files or Information
• T1485 Data Destruction
• T1059.005 Visual Basic
• T1105 Ingress Tool Transfer
• T1033 System Owner/User Discovery
• T1589.002 Email Addresses
• T1071.001 Web Protocols
• T1087.002 Domain Account
• T1082 System Information Discovery
• T1005 Data from Local System
• T1195 Supply Chain Compromise
• T1593 Search Open Websites/Domains
• T1036.005 Match Legitimate Resource Name or Location
• T1676 Linked Devices
• T1409 Stored Application Data
• T1660 Phishing
• T0819 Exploit Public-Facing Application
• T1701.001 PowerShell
• T0884 Connection Proxy
• T1701.002 Windows Command Shell

ATT&CK technique IDs (denormalized)

• T0819
• T0884
• T1003.001
• T1003.003
• T1005
• T1018
• T1021.002
• T1027
• T1027.010
• T1033
• T1036
• T1036.005
• T1040
• T1041
• T1047
• T1049
• T1053.005
• T1056.001
• T1059.001
• T1059.005
• T1070.004
• T1071.001
• T1072
• T1078
• T1078.002
• T1082
• T1083
• T1087.002
• T1087.003
• T1090
• T1102.002
• T1105
• T1106
• T1132.001
• T1133
• T1140
• T1190
• T1195
• T1195.002
• T1199
• T1203
• T1204.001
• T1204.002
• T1213.006
• T1218.011
• T1219
• T1409
• T1485
• T1486
• T1489
• T1490
• T1491.002
• T1499
• T1505.003
• T1539
• T1555.003
• T1561.002
• T1566.001
• T1566.002
• T1570
• T1571
• T1583
• T1583.001
• T1583.004
• T1584.004
• T1584.005
• T1585.001
• T1585.002
• T1586.001
• T1587.001
• T1588.002
• T1588.006
• T1589.002
• T1589.003
• T1590.001
• T1591.002
• T1592.002
• T1593
• T1594
• T1595.002
• T1598.003
• T1608.001
• T1660
• T1676
• T1701.001
• T1701.002

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 2 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

• CyberGate:
• Cyber Eye RAT:

MITRE ATT&CK Software

• Bad Rabbit (S0606) — malware
• Mimikatz (S0002) — tool
• Exaramel for Linux (S0401) — malware
• Exaramel for Windows (S0343) — malware
• GreyEnergy (S0342) — malware
• PsExec (S0029) — tool
• Prestige (S1058) — malware
• P.A.S. Webshell (S0598) — malware
• AcidPour (S1167) — malware
• VPNFilter (S1010) — malware
• Neo-reGeorg (S1189) — malware
• Cyclops Blink (S0687) — malware
• SDelete (S0195) — tool
• Empire (S0363) — tool
• Kapeka (S1190) — malware
• AcidRain (S1125) — malware
• Industroyer (S0604) — malware
• Industroyer2 (S1072) — malware
• BlackEnergy (S0089) — malware
• Cobalt Strike (S0154) — malware
• NotPetya (S0368) — malware
• KillDisk (S0607) — malware
• Net (S0039) — tool
• PoshC2 (S0378) — tool
• Impacket (S0357) — tool
• Invoke-PSImage (S0231) — tool
• Olympic Destroyer (S0365) — malware
• CHEMISTGAMES (S0555) — malware

Attribution and Evidence

Country of Origin: Russia Additional attribution information pending cataloguing.

References

[1] mitre-attack [13] Leonard TAG 2023 Billy Leonard. (2023, April 19). Ukraine remains Russia’s biggest cyber focus in 2023. Retrieved March 1, 2024. [14] US District Court Indictment GRU Oct 2018 Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020. [15] Dragos ELECTRUM Dragos. (2017, January 1). ELECTRUM Threat Profile. Retrieved June 10, 2020. [16] F-Secure BlackEnergy 2014 F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016. [17] iSIGHT Sandworm 2014 Hultquist, J.. (2016, January 7). Sandworm Team and the Ukrainian Power Authority Attacks. Retrieved October 6, 2017. [18] CrowdStrike VOODOO BEAR Meyers, A. (2018, January 19). Meet CrowdStrike’s Adversary of the Month for January: VOODOO BEAR. Retrieved May 22, 2018. [19] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [20] Microsoft Prestige ransomware October 2022 MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023. [21] InfoSecurity Sandworm Oct 2014 Muncaster, P.. (2014, October 14). Microsoft Zero Day Traced to Russian ‘Sandworm’ Hackers. Retrieved October 6, 2017. [22] NCSC Sandworm Feb 2020 NCSC. (2020, February 20). NCSC supports US advisory regarding GRU intrusion set Sandworm. Retrieved June 10, 2020. [23] USDOJ Sandworm Feb 2020 Pompeo, M. (2020, February 20). The United States Condemns Russian Cyber Attack Against the Country of Georgia. Retrieved September 12, 2024. [24] mandiant_apt44_unearthing_sandworm Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024. [25] US District Court Indictment GRU Unit 74455 October 2020 Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020. [26] Secureworks IRON VIKING Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020. [27] UK NCSC Olympic Attacks October 2020 UK NCSC. (2020, October 19). UK exposes series of Russian cyber attacks against Olympic and Paralympic Games . Retrieved November 30, 2020.

Recent News

Latest articles from security news feeds mentioning this actor.

• ‘Sandworm’ Chains Cisco Vulnerabilities to Deploy Cyclops Blink DarkReading — 2026-09-14
• Sandworm hackers target IT pros with trojanized WireGuard VPN client BleepingComputer — 2026-08-11