# Sandworm

> Sandworm (APT44 / Seashell Blizzard, GRU Unit 74455) adversary-emulation playbook — IT→OT intrusion ending in ICS manipulation or destructive impact, executed with living-off-the-land Windows tooling. SAFETY-CRITICAL: destructive and ICS-write steps are canary/lab-only and gated on explicit OT authorization. Use when emulating Sandworm against an ICS/OT or critical-infrastructure estate. Triggers on: 'emulate Sandworm', 'APT44', 'Seashell Blizzard', 'Voodoo Bear', 'ICS attack', 'OT destructive', 'Industroyer', 'NotPetya'.

- Skill: `purpleailab/sandworm` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/sandworm`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/sandworm/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/sandworm

---


# Sandworm — Adversary Emulation Playbook

> Tier-3 Russian GRU (Unit 74455) sabotage actor. Sandworm's signature is a patient,
> living-off-the-land IT intrusion that **crosses the IT/OT boundary and ends in physical or
> data destruction** (Ukraine grid via Industroyer; NotPetya pseudo-ransomware wiper).
> **This is the highest-risk emulation in the catalog.** Every ICS-write and destructive step
> is canary/lab-only and gated on explicit operator + OT-engineer authorization.

## When to emulate Sandworm

- Target operates **ICS/OT** or critical infrastructure (energy, water, manufacturing,
  transportation) and the client wants the IT→OT kill chain and destructive-impact resilience
  tested — typically as a tabletop-plus or against a dedicated OT lab segment.
- The client's threat model includes destructive/disruptive nation-state actors (see the
  industry → actor map in `../../references/apt-groups.md`).

## ThreatProfile seed (`plan/threat-profile.json`)

```json
{
  "engagement_name": "<fill>",
  "actor_name": "Sandworm-like (APT44 / Seashell Blizzard)",
  "actor_aliases": ["Voodoo Bear", "Telebots", "IRON VIKING", "Seashell Blizzard", "APT44"],
  "group_id": "G0034",
  "tier": "tier-3",
  "sophistication": "nation-state",
  "motivation": "disruption",
  "initial_access": ["T1190", "T1566.001", "T1195.002", "T1133"],
  "key_ttps": ["T1059.003", "T1003.001", "T1021.002", "T1570", "T1485", "T1561.002", "T1486", "T0831", "T0816", "T0855"],
  "tools": ["NetExec", "Impacket", "Sliver", "pymodbus / python-snap7 (read-first)", "marked canary wiper (lab only)"],
  "infrastructure": ["Compromised edge/VPN foothold", "Engineering-workstation jump host (IT->OT pivot)", "Sliver HTTPS C2"],
  "recent_cti_delta": "2022 Industroyer2 against the Ukrainian power grid; sustained destructive operations vs Ukraine/NATO; LOTL with native Windows tools (vssadmin, wbadmin, bcdedit) before detonation.",
  "confidence": "probable"
}
```

## Kill-chain emulation

| # | Phase | MITRE | Emulated action | Executing agent → skill |
|---|-------|-------|-----------------|-------------------------|
| 1 | Recon | T1590 / T1595 | Map external surface + IT/OT (Purdue) boundary; fingerprint ICS protocols | recon → `/skills/standard/recon/active-recon/SKILL.md`; route ICS via `/skills/standard/exploit/ics-ot/SKILL.md` |
| 2 | Initial Access | T1190 | Exploit edge/VPN/public-facing app | exploit → `/skills/standard/exploit/web/cve/SKILL.md` |
| 3 | Initial Access (alt) | T1566.001 | Spearphishing attachment to IT staff | phisher → `/skills/standard/phisher/SKILL.md` |
| 4 | Initial Access (alt) | T1195.002 | Trojanized software-update / supply chain (NotPetya pattern) | exploit → `/skills/standard/exploit/supplychain/dep-confusion/SKILL.md` |
| 5 | Credential Access | T1003.001 | LSASS dump on IT hosts (LOTL) | post-exploit → `/skills/standard/post-exploit/credential-access/SKILL.md` |
| 6 | Lateral (IT) | T1021.002 / T1570 | SMB admin-share spread + lateral tool transfer | post-exploit → `/skills/standard/post-exploit/lateral-movement/SKILL.md`; `/skills/standard/ad/netexec/SKILL.md` |
| 7 | IT→OT pivot | T1021 | Reach engineering workstation / OT jump host across the boundary | post-exploit → `/skills/standard/post-exploit/lateral-movement/SKILL.md` |
| 8 | ICS Impact **(GATED)** | T0855 / T0831 / T0816 | Read PLC state; **authorized single benign write** to a lab test point | exploit → `/skills/standard/exploit/ics-ot/modbus/SKILL.md` (or `s7comm` / `dnp3` / `bacnet`) |
| 9 | Destructive **(CANARY)** | T1485 / T1561.002 / T1486 | Marked canary wipe / pseudo-ransom on a lab host only | post-exploit → `/skills/standard/post-exploit/reporting/SKILL.md` (evidence) |
| 10 | C2 | T1071.001 | Sliver HTTPS beacon for the IT-side foothold | post-exploit → `/skills/standard/post-exploit/c2-sliver/SKILL.md` |

## CONOPS kill_chain (copy into `conops.json`)

1. `recon` — external surface + Purdue/IT-OT mapping + ICS fingerprint (row 1).
2. `initial-access` — edge exploit / spearphish / supply chain (2-4).
3. `post-exploit` — LSASS, IT lateral, IT→OT pivot, **gated** ICS read/write, **canary** destruction (5-9).
4. `c2` — Sliver HTTPS (10).
5. `exfiltration` — optional espionage subset (engineering docs, PLC logic) if in scope.

## OPSEC & signature fidelity

- **Quiet until detonation.** Sandworm stages with native Windows tools (cmd, vssadmin,
  wbadmin, bcdedit) and only becomes loud at the impact phase — mirror that: blend during
  staging, then a single controlled, authorized impact event.
- **Mirror the IT→OT pivot.** The fidelity-defining behavior is crossing the boundary via an
  engineering workstation, not the wiper binary.
- ICS reconnaissance is read-only and OPSEC-safe; the noise/risk is entirely in the write.

## RoE / safety gates — READ BEFORE PLANNING

- **ICS writes move physical actuators.** Default to **read-only** enumeration. Any write/
  control-class action requires explicit written OT-write authorization in the RoE and an
  **OT safety engineer on the contact plan**, per `/skills/standard/exploit/ics-ot/SKILL.md`
  ("SAFETY FIRST").
- **Destruction is lab/canary only.** Never run a real wiper or encryptor against production.
  Use a marked canary file set on an isolated lab host.
- `abort.json` MUST carry an `EMERGENCY` trigger (see `/skills/standard/soundwave/abort-template/SKILL.md`):
  *"Tier-3 destructive emulation against critical infrastructure — halt + operator-page +
  1hr cooldown"* — plus *"any ICS write outside the named lab test point."*
- Schedule a maintenance window with physical safety standby before any OT step.

## Deconfliction

- Notify the OT/SOC team and name the exact ICS test device(s) and coil/register addresses in
  `deconfliction.json`; nothing outside that list may be written.
- Tag the canary wiper artifact and Sliver implant with the engagement ID; record the lab
  host inventory in `cleanup.json`.

## Fidelity notes (deviations)

- **No real Industroyer/BlackEnergy/NotPetya samples.** Emulate the *sequence* — IT foothold →
  LOTL lateral → engineering-workstation pivot → ICS command — with pymodbus/python-snap7
  (read-first) and Sliver.
- The "manipulation of control" step is a single authorized benign write to a lab test point
  (e.g., toggle a non-safety-critical coil) **with the OT engineer present**, or fully
  simulated when no lab is available.
- The destructive finale is a canary-only proof that the access *would* allow impact — the
  deliverable distinguishes "impact demonstrated on canary" from "production impact" (never the latter).