Sandworm Team

Sandworm Team (Voodoo Bear, Seashell Blizzard, ELECTRUM) — Adversary Emulation Profile

Sandworm Team (MITRE ATT&CK G0034; also tracked as APT44, Voodoo Bear, Seashell Blizzard, ELECTRUM, Telebots, IRON VIKING, IRIDIUM, FROZENBARENTS, and historically BlackEnergy/Quedagh) is a destructive Russian state threat group attributed to the GRU's Main Center for Special Technologies (GTsST), military unit 74455, active since at least 2009. Unlike espionage-focused peers, Sandworm is the GRU's premier sabotage and influence unit: it pairs conventional intrusion tradecraft with bespoke ICS/OT attack capability, disk wipers, fake ransomware, hacktivist-persona leaks, and disruptive operations timed to geopolitical and kinetic events. It is the only actor publicly documented to have triggered electric-grid blackouts via cyberattack (Ukraine, 2015 and 2016) and later repeated an OT grid attack in 2022. This profile maps Sandworm's signature TTPs to ATT&CK so Decepticon can emulate them within an authorized engagement and so the blue cell can anticipate detection.

Attribution & motivation

• Sponsor / nation: Russian Federation — GRU (Main Intelligence Directorate), Main Center for Special Technologies (GTsST), military unit 74455. Attribution is high confidence, backed by the October 2020 US DOJ indictment of six named Unit 74455 officers, concurrent UK/EU/Five Eyes statements, and Mandiant's April 2024 graduation of the cluster to the named APT designation APT44.
• Motivation: Primarily destructive/disruptive sabotage and influence operations in support of Russian military and political objectives, with espionage and pre-positioning for access as enabling activity. Financial theft is rare and generally a cover (e.g., NotPetya and Prestige used ransomware/wiper framing for destructive ends rather than profit).
• Strategic character: Operations are frequently synchronized with kinetic events (e.g., the October 2022 OT attack coincided with Russian missile strikes on Ukraine) and elections, and use false hacktivist or criminal personas for plausible deniability.

Targeting

• Sectors: Energy/electric utilities and ICS/OT operators (primary signature), oil and gas, government, defense and arms manufacturing, transportation and shipping, telecommunications, media, financial services, and civil society. The BadPilot subgroup (Microsoft, 2025) broadened opportunistic access into any Internet-facing enterprise software it can exploit.
• Regions: Heaviest focus on Ukraine and Russia's "near abroad" (e.g., Georgia, Poland, Kazakhstan). Global spillover and deliberate targeting includes Western Europe, the United States and United Kingdom (expanded since early 2024 via BadPilot), and one-off high-impact events worldwide (e.g., the 2018 PyeongChang Winter Olympics, the OPCW, the 2017 French presidential campaign).
• Victim profile: Critical-infrastructure and government operators of strategic value to Russia, organizations tied to events Moscow seeks to disrupt, and any edge-exposed organization useful as a foothold or for later sabotage/influence.

Notable campaigns

• 2015-12 — Ukraine power grid (BlackEnergy/KillDisk): First-of-its-kind cyber-induced blackout; operators used stolen credentials and HMI access to open breakers, then KillDisk to hamper recovery. (DOJ 2020 indictment; MITRE G0034)
• 2016-12 — Ukraine power grid (Industroyer/CRASHOVERRIDE): Purpose-built ICS malware (S0604) automated breaker manipulation in Kyiv. (Google Cloud / Mandiant)
• 2017-06 — NotPetya (S0368): Supply-chain compromise of the M.E.Doc Ukrainian tax-software updater delivered a self-propagating wiper masquerading as ransomware, causing global multi-billion-dollar damage. (DOJ 2020 indictment; MITRE G0034)
• 2017 — French presidential campaign targeting & 2017-06 Bad Rabbit (S0606): Spearphishing/influence operations and a separate ransomware-style outbreak. (DOJ 2020 indictment)
• 2018-02 — Olympic Destroyer (S0365): Disruptive wiper against the PyeongChang Winter Olympics IT systems, deliberately seeded with false-flag artifacts. (DOJ 2020 indictment; MITRE G0034)
• 2018 — OPCW targeting: Operations against the Organisation for the Prohibition of Chemical Weapons. (DOJ 2020 indictment)
• 2019 — Georgia website defacement & disruption: Defaced ~15,000 Georgian government/private websites and disrupted broadcasters after compromising a hosting provider. (MITRE G0034; DOJ)
• 2022-02/03 — Ukraine wiper wave (CaddyWiper S0693, AcidRain S1125): Destructive malware around the full-scale invasion; AcidRain bricked Viasat KA-SAT modems. (Mandiant APT44)
• 2022-04 — Industroyer2: Attempted blackout against a Ukrainian electricity provider using an Industroyer variant plus CaddyWiper. (Google Cloud / Mandiant)
• 2022-10 — Living-off-the-land OT grid attack: Used a malicious ISO (a.iso) → lun.vbs → n.bat → native MicroSCADA scilc.exe (SCIL-API) to issue unauthorized breaker commands (Oct 10), followed two days later by CaddyWiper deployed via GPO. (Google Cloud / Mandiant)
• 2022-10/11 — Prestige ransomware (S1058): Encrypted logistics/transport organizations in Ukraine and Poland. (Microsoft; MITRE G0034)
• 2024-04 — APT44 designation (Mandiant): Formal graduation reflecting sustained global sabotage, espionage, and influence activity.
• 2021-2025 — BadPilot subgroup global access operation: Multiyear opportunistic exploitation of Internet-facing software (Exchange, Outlook, ConnectWise ScreenConnect, Fortinet, Zimbra, OpenFire, JetBrains TeamCity) to establish persistent footholds, expanding to US/UK targets since early 2024. (Microsoft, 2025-02)

TTPs by ATT&CK tactic

Reconnaissance & Resource Development

• T1595.002 / T1592.002 / T1589.002 / T1589.003 / T1590.001 / T1591.002 / T1593 / T1594 — Vulnerability-scans target infrastructure; profiles software in use for supply-chain ops; harvests emails, employee names, domain properties, partner/business relationships; researches third-party and victim-owned sites (e.g., Ukraine's EDRPOU registry, Georgian parliament domain).
• T1583.001 / T1583.004 / T1584.004 / T1584.005 — Registers look-alike domains (login/password-reset pages), leases servers via resellers, compromises legitimate Linux EXIM servers, and operates large SOHO-device botnets.
• T1585.001 / T1585.002 / T1586.001 — Establishes social-media and email accounts (hacktivist personas) and compromises real social accounts for leak/influence ops.
• T1587.001 / T1588.002 / T1588.006 / T1608.001 — Develops custom malware (NotPetya, Olympic Destroyer) and acquires offensive tooling (Cobalt Strike, Empire, PoshC2, Impacket, Invoke-PSImage, RemoteExec); stages trojanized installers on forums.

Initial Access

• T1190 — Exploits public-facing applications (BadPilot: ScreenConnect CVE-2024-1709, Fortinet CVE-2023-48788, Exchange CVE-2021-34473, Outlook CVE-2023-23397, Zimbra CVE-2022-41352, OpenFire CVE-2023-32315, TeamCity CVE-2023-42793; ICS HMIs GE Cimplicity/Advantech WebAccess).
• T1566.001 / T1566.002 / T1598.003 — Spearphishing with malicious Office/ZIP attachments and credential-harvesting links.
• T1195 / T1195.002 — Supply-chain compromise (M.E.Doc updater for NotPetya; forum-staged installers).
• T1133 / T1078 / T1078.002 / T1199 — VPN/SSH external remote services, valid (often domain-admin) accounts, and trusted cross-organization network links.

Execution

• T1059.001 / T1059.003 / T1059.005 — PowerShell (in-memory credential tools), Windows Command Shell via MS-SQL xp_cmdshell, and VBScript/VBA (e.g., lun.vbs, vba_macro.exe).
• T1047 / T1106 / T1203 / T1204.001 / T1204.002 — Impacket WMIexec, native API calls, client-side exploits (CVE-2014-4114 OLE, CVE-2013-3906 TIFF), and macro/link user-execution lures.
• T1219 / T1072 — ICS client software and remote-admin tools to operate breakers; RemoteExec for agentless RCE.

Persistence

• T1543.002 / T1543.003 / T1136.002 / T1053.005 / T1505.001 / T1505.003 / T1554 / T1098 — systemd services (GOGETTER), Windows services (Industroyer), created privileged domain accounts, scheduled tasks (SHARPIVORY), MS-SQL stored procedures, web shells (P.A.S., Neo-REGEORG), a trojanized Notepad binary, and SQL linked-server account manipulation.

Privilege Escalation / Defense Evasion

• T1484.001 — Group Policy Object modification to deploy and execute malware (CaddyWiper, Prestige) across a domain from the DC.
• T1027 / T1027.002 / T1027.010 / T1140 — Base64/ROT13/AES/zlib obfuscation, UPX-packed Mimikatz, multi-stage decode chains.
• T1036 / T1036.004 / T1036.005 / T1036.008 / T1036.010 — Masquerades installers as Windows updates, services as legitimate (GOGETTER), binaries as explorer.exe, executables as .txt, and accounts as admin/система.
• T1112 / T1685 / T1685.001 / T1070.004 / T1218.011 — Lowers registry internet-security settings, disables tools and Windows event logging, deletes attack files, and proxies execution via rundll32.exe.

Credential Access

• T1003.001 / T1003.003 / T1056.001 / T1110 / T1539 / T1555.003 / T1040 — LSASS dumping (modified Mimikatz, comsvcs.dll, plainpwd), NTDS extraction via ntdsutil.exe, keylogging (SetWindowsHookEx), RPC brute force, browser session-cookie and saved-password theft (CredRaptor), and network sniffing (intercepter-NG, BlackEnergy sniffer). Also alters OWA sign-in pages to capture credentials in real time (BadPilot).

Discovery

• T1087.002 / T1087.003 / T1018 / T1082 / T1083 / T1049 / T1033 — LDAP/AD account enumeration, M.E.Doc account harvesting, remote-system discovery, OS/system info, file/directory enumeration, network-connection and RDP-session mapping, and user discovery.

Lateral Movement

• T1021.002 / T1570 — SMB/ADMIN$ copy and net use; lateral tool transfer (e.g., copying Prestige to the DC via GPO, ICS payload staging).

Command & Control

• T1071.001 / T1095 / T1571 / T1090 / T1102.002 / T1132.001 / T1572 / T1055 / T1105 — HTTP(S) C2 (BlackEnergy, BCS-server), non-application-layer/TLS-tunneled proxying, non-standard ports (SSH 6789), internal proxies, bidirectional web-service C2 (Telegram Bot API, M.E.Doc update requests), Base64-over-HTML encoding, Yamux/TLS tunneling (GOGETTER), process injection into svchost.exe, and ingress tool transfer.

Collection & Exfiltration

• T1005 / T1213.006 / T1041 — Local-system document theft, database exfiltration via Adminer, and exfil over the HTTP C2 channel.

Impact (signature)

• T1485 — Data destruction with CaddyWiper, SDelete, BlackEnergy KillDisk, and JUNKMAIL (file/disk overwrite).
• T1561.002 — Disk-structure wipe (KillDisk MBR corruption).
• T1486 / T1490 / T1489 — Prestige ransomware encryption, deletion of backup catalog and volume shadow copies, and service-stop (MSSQL) to ensure encryption.
• T1491.002 / T1499 — External website defacement (~15,000 Georgian sites) and endpoint denial-of-service.
• ICS impact — Native-binary breaker manipulation (MicroSCADA scilc.exe / SCIL-API, ATT&CK ICS T1692.001/T0831), serial-to-ethernet firmware overwrite to block OT messages (T1693.001/T1691), causing loss of control/availability and ~6-hour regional blackouts.

Signature tooling & malware

Emulation guidance (Decepticon)

Authorized use only: every action below is destructive-capable and must run strictly inside the documented engagement scope, on approved targets, with rules-of-engagement sign-off and (for any wipe/encrypt/OT step) explicit written authorization and reversible/lab-only execution. Never touch real ICS/OT or production data outside an isolated test range.

• Edge-exploit initial access (BadPilot style, T1190): Use Decepticon's recon/scanning and exploit tooling against in-scope perimeter apps; emulate ScreenConnect/Fortinet/Exchange-class footholds. Chain to web-shell drop (T1505.003) via the bash tool and the lateral-movement skill.
• Phishing & supply-chain (T1566/T1195): Drive the spearphishing/credential-harvest path with Decepticon's phishing/initial-access capability; emulate trojanized-installer staging only against engagement-provided artifacts.
• Valid-account + AD escalation (T1078.002/T1003/T1087/T1484.001): Use the AD skills to enumerate via LDAP, dump LSASS/NTDS (emulating modified-Mimikatz/ntdsutil/comsvcs.dll), and reach Domain Admin — Sandworm's defining pivot is GPO-based mass deployment, so practice pushing a benign payload domain-wide via GPO.
• C2 (T1071.001/T1572/T1102.002): Stand up c2/sliver with HTTPS and TLS-tunneled (Yamux-like) profiles; emulate Telegram/web-service bidirectional C2 with a benign beacon and internal-proxy pivoting.
• Defense evasion (T1027/T1036/T1685.001/T1070.004): Use the defense-evasion skill to pack/obfuscate payloads, masquerade binaries and accounts (explorer.exe, система), disable event logging, and clean up artifacts — then verify the blue cell catches them.
• Lateral movement (T1021.002/T1570/T1047): Use the lateral-movement skill for SMB/ADMIN$ copy, net use, Impacket WMIexec, and GPO/RemoteExec-style mass execution to mirror Sandworm's DC-to-fleet propagation.
• Cloud / hosting tradecraft (T1583/T1584): Use cloud skills to provision reseller-leased infra and look-alike domains for the engagement's C2 and phishing surface.
• Impact emulation (T1485/T1486/T1490/T1561.002): ONLY in an isolated lab range — emulate wiper behavior with SDelete-style overwrites, shadow-copy/backup deletion, and service-stop-then-encrypt sequencing to test EDR/recovery. Do not run destructive payloads against any host the customer needs.
• OT/ICS (ICS T1692.001/T0831, etc.): Treat as tabletop/range-only. Emulate the living-off-the-land chain (ISO → VBS → batch → native SCADA utility) conceptually so the blue cell can build detections; never issue control commands against real equipment.

Detection & defense

• Edge/initial access: Patch and monitor Internet-facing apps (Exchange/Outlook, ScreenConnect, Fortinet, Zimbra, OpenFire, TeamCity); alert on new web shells (T1505.003) and anomalous OWA sign-in-page modifications/DNS changes (BadPilot credential capture).
• AD & GPO abuse (T1484.001): Audit GPO creation/linking and SYSVOL changes; alert on scheduled tasks or services deployed fleet-wide from a DC; monitor ntdsutil.exe, LSASS access, and comsvcs.dll MiniDump (T1003).
• LotL execution: Detect wscript.exe/cscript.exe spawning batch files, mounted ISO autoruns, xp_cmdshell enablement, rundll32.exe proxy execution (T1218.011), and PowerShell that loads code in memory; baseline native SCADA utilities (e.g., scilc.exe) and alert on any unexpected invocation.
• Credential theft: Deploy LSASS protection (Credential Guard/RunAsPPL), browser-credential and session-cookie monitoring, and network-sniffer detection.
• C2 / evasion: Inspect TLS-tunneled and non-standard-port traffic, Telegram/cloud-service beaconing, and svchost.exe injection; alert on Windows event-log clearing/disabling (T1685.001) and mass file deletion.
• Destructive containment: Maintain offline, immutable backups; alert on volume-shadow-copy and backup-catalog deletion (T1490), vssadmin/wbadmin misuse, mass service stops (T1489), and rapid multi-host file overwrite (T1485). Segment IT from OT; restrict and monitor HMI/ICS-client access and serial-to-ethernet device firmware integrity.

Sources

• MITRE ATT&CK — Sandworm Team (G0034): https://attack.mitre.org/groups/G0034/
• Google Cloud (Mandiant) — "Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology": https://cloud.google.com/blog/topics/threat-intelligence/sandworm-disrupts-power-ukraine-operational-technology/
• Google Cloud (Mandiant) — "Unearthing APT44: Russia's Notorious Cyber Sabotage Unit Sandworm": https://cloud.google.com/blog/topics/threat-intelligence/apt44-unearthing-sandworm
• Microsoft Security Blog — "The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation": https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/
• Wikipedia (corroborating overview, DOJ indictment summary) — "Sandworm (hacker group)": https://en.wikipedia.org/wiki/Sandworm_(hacker_group)