← Back to Actors
Sandworm Team
Sandworm TeamELECTRUMTelebotsIRON VIKINGBlackEnergy (Group)QuedaghVoodoo BearIRIDIUMSeashell BlizzardFROZENBARENTSAPT44
[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020) In October 2020, the US indicted six GRU Unit 74455 officers ...
79
Techniques
67
Covered
12
Gaps
85%
Coverage
Coverage67/79
GAPS (12)
COVERED (67)
T1003.001LSASS Memory111 det.T1003.003NTDS36 det.T1005Data from Local System51 det.T1018Remote System Discovery52 det.T1021.002SMB/Windows Admin Shares74 det.T1027Obfuscated Files or Information707 det.T1027.010Command Obfuscation42 det.T1033System Owner/User Discovery62 det.T1036Masquerading672 det.T1036.005Match Legitimate Resource Name or Location49 det.T1040Network Sniffing15 det.T1041Exfiltration Over C2 Channel32 det.T1047Windows Management Instrumentation88 det.T1049System Network Connections Discovery23 det.T1053.005Scheduled Task100 det.T1056.001Keylogging4 det.T1059.001PowerShell384 det.T1059.005Visual Basic71 det.T1070.004File Deletion46 det.T1071.001Web Protocols83 det.T1072Software Deployment Tools13 det.T1078Valid Accounts320 det.T1078.002Domain Accounts28 det.T1082System Information Discovery91 det.T1083File and Directory Discovery49 det.T1087.002Domain Account58 det.T1090Proxy50 det.T1102.002Bidirectional Communication17 det.T1105Ingress Tool Transfer199 det.T1106Native API30 det.T1132.001Standard Encoding5 det.T1133External Remote Services80 det.T1140Deobfuscate/Decode Files or Information59 det.T1190Exploit Public-Facing Application240 det.T1195Supply Chain Compromise42 det.T1195.002Compromise Software Supply Chain24 det.T1199Trusted Relationship6 det.T1203Exploitation for Client Execution81 det.T1204.001Malicious Link11 det.T1204.002Malicious File468 det.T1213.006Databases2 det.T1218.011Rundll3278 det.T1219Remote Access Tools51 det.T1485Data Destruction100 det.T1486Data Encrypted for Impact400 det.T1489Service Stop59 det.T1490Inhibit System Recovery65 det.T1491.002External Defacement1 det.T1499Endpoint Denial of Service11 det.T1505.003Web Shell70 det.T1539Steal Web Session Cookie21 det.T1555.003Credentials from Web Browsers16 det.T1561.002Disk Structure Wipe3 det.T1566.001Spearphishing Attachment1144 det.T1566.002Spearphishing Link1194 det.T1570Lateral Tool Transfer23 det.T1571Non-Standard Port17 det.T1583Acquire Infrastructure3 det.T1583.001Domains69 det.T1587.001Malware10 det.T1588.002Tool13 det.T1589.002Email Addresses2 det.T1590.001Domain Properties2 det.T1592.002Software1 det.T1595.002Vulnerability Scanning13 det.T1598.003Spearphishing Link353 det.T1608.001Upload Malware3 det.