Sandworm Team
Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455. This group has been active since at least 2009. In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic…
- ATT&CK ID
- G0034
- Origin
- Russia
- Weather family
- Blizzard
- Techniques
- 64
- Tools
- 27
Also tracked as ELECTRUM · Telebots · IRON VIKING · BlackEnergy (Group) · Quedagh · Voodoo Bear · IRIDIUM · Seashell Blizzard · FROZENBARENTS · APT44
Vulnerabilities it has exploited
- CVE-2013-3906 Microsoft Graphics ComponentUnscored · exploited in the wild
- CVE-2014-4114 Microsoft WindowsUnscored · exploited in the wild
Techniques
Reconnaissance
Gather Victim Identity InformationGather Victim Network InformationGather Victim Org InformationGather Victim Host InformationSearch Open Websites/DomainsSearch Victim-Owned WebsitesActive ScanningPhishing for Information
Resource Development
Acquire InfrastructureCompromise InfrastructureEstablish AccountsCompromise AccountsDevelop CapabilitiesObtain CapabilitiesStage Capabilities
Initial Access
Valid AccountsExternal Remote ServicesExploit Public-Facing ApplicationSupply Chain CompromiseTrusted RelationshipPhishing
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterSoftware Deployment ToolsNative APIExploitation for Client ExecutionUser Execution
Persistence
Scheduled Task/JobValid AccountsExternal Remote ServicesServer Software Component
Privilege Escalation
Scheduled Task/JobValid Accounts
Stealth
Obfuscated Files or InformationMasqueradingIndicator RemovalValid AccountsDeobfuscate/Decode Files or InformationSystem Binary Proxy Execution
Credential Access
OS Credential DumpingNetwork SniffingInput CaptureSteal Web Session CookieCredentials from Password Stores
Discovery
Remote System DiscoverySystem Owner/User DiscoveryNetwork SniffingSystem Network Connections DiscoverySystem Information DiscoveryFile and Directory DiscoveryAccount Discovery
Lateral Movement
Remote ServicesSoftware Deployment ToolsLateral Tool Transfer
Collection
Data from Local SystemInput CaptureData from Information Repositories
Command and Control
Application Layer ProtocolProxyWeb ServiceIngress Tool TransferData EncodingRemote Access ToolsNon-Standard Port
Exfiltration
Impact
Data DestructionData Encrypted for ImpactService StopInhibit System RecoveryDefacementEndpoint Denial of ServiceDisk Wipe
Software
AcidPour · AcidRain · Bad Rabbit · BlackEnergy · Cobalt Strike · Cyclops Blink · Empire · Exaramel for Linux · Exaramel for Windows · GreyEnergy · Impacket · Industroyer · Industroyer2 · Invoke-PSImage · Kapeka · KillDisk · Mimikatz · Neo-reGeorg · Net · NotPetya · Olympic Destroyer · P.A.S. Webshell · PoshC2 · Prestige · PsExec · SDelete · VPNFilter