Sandworm Team

Threat actor

Attributed to Russia by MITRE ATT&CK (source). An attribution, not a proven fact.

Names and who uses them

Sandworm TeamOur name
Voodoo BearCrowdStrike
ELECTRUMDragos
APT44Mandiant
IRIDIUMMicrosoft
Seashell BlizzardMicrosoft
FROZENBARENTSMITRE ATT&CK
QuedaghMITRE ATT&CK
BlackEnergy (Group)NCSC
TelebotsNCSC
IRON VIKINGSecureworks

Targets

Sectors: Government, Chemical

Regions: United States, Ukraine, France

Source: MITRE ATT&CK

Known techniques

T1003.001LSASS Memory
T1003.003NTDS
T1005Data from Local System
T1018Remote System Discovery
T1021.002SMB/Windows Admin Shares
T1027Obfuscated Files or Information
T1027.010Command Obfuscation
T1033System Owner/User Discovery
T1036Masquerading
T1036.005Match Legitimate Resource Name or Location
T1040Network Sniffing
T1041Exfiltration Over C2 Channel
T1047Windows Management Instrumentation
T1049System Network Connections Discovery
T1053.005Scheduled Task
T1056.001Keylogging
T1059.001PowerShell
T1059.005Visual Basic
T1070.004File Deletion
T1071.001Web Protocols
T1072Software Deployment Tools
T1078Valid Accounts
T1078.002Domain Accounts
T1082System Information Discovery
T1083File and Directory Discovery
T1087.002Domain Account
T1087.003Email Account
T1090Proxy
T1102.002Bidirectional Communication
T1105Ingress Tool Transfer
T1106Native API
T1132.001Standard Encoding
T1133External Remote Services
T1140Deobfuscate/Decode Files or Information
T1190Exploit Public-Facing Application
T1195Supply Chain Compromise
T1195.002Compromise Software Supply Chain
T1199Trusted Relationship
T1203Exploitation for Client Execution
T1204.001Malicious Link

Source: MITRE ATT&CK

Malware and tools used

Source: MITRE ATT&CK

Recent news

No stories yet.