Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.12 This group has been active since at least 2009.3456 In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.78 Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.9
- US District Court Indictment GRU Unit 74455 October 2020
- UK NCSC Olympic Attacks October 2020
- iSIGHT Sandworm 2014
- CrowdStrike VOODOO BEAR
- USDOJ Sandworm Feb 2020
- NCSC Sandworm Feb 2020
- US District Court Indictment GRU Unit 74455 October 2020
- UK NCSC Olympic Attacks October 2020
- US District Court Indictment GRU Oct 2018
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Sandworm Team | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | ELECTRUM | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Telebots | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | IRON VIKING | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | BlackEnergy (Group) | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Quedagh | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Voodoo Bear | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | IRIDIUM | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Seashell Blizzard | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | FROZENBARENTS | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | APT44 | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1040 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1539 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1072 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1106 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1489 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1499 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1561.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1592.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1491.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1594 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1490 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1485 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1593 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| also_known_as | 镭眼 | — → … | 60 | src_0e0b2199-b766-47ad-af5a-891db001f83e |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1018 | Remote System Discovery | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1027 | Obfuscated Files or Information | — |
| T1027.010 | Command Obfuscation | — |
| T1033 | System Owner/User Discovery | — |
| T1036 | Masquerading | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1040 | Network Sniffing | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1056.001 | Keylogging | — |
| T1059.001 | PowerShell | — |
| T1059.005 | Visual Basic | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1072 | Software Deployment Tools | — |
| T1078 | Valid Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087.002 | Domain Account | — |
| T1087.003 | Email Account | — |
| T1090 | Proxy | — |
| T1102.002 | Bidirectional Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1106 | Native API | — |
| T1132.001 | Standard Encoding | — |
| T1133 | External Remote Services | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1195 | Supply Chain Compromise | — |
| T1195.002 | Compromise Software Supply Chain | — |
| T1199 | Trusted Relationship | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1213.006 | Databases | — |
| T1218.011 | Rundll32 | — |
| T1219 | Remote Access Tools | — |
| T1485 | Data Destruction | — |
| T1486 | Data Encrypted for Impact | — |
| T1489 | Service Stop | — |
| T1490 | Inhibit System Recovery | — |
| T1491.002 | External Defacement | — |
| T1499 | Endpoint Denial of Service | — |
| T1505.003 | Web Shell | — |
| T1539 | Steal Web Session Cookie | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1561.002 | Disk Structure Wipe | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1570 | Lateral Tool Transfer | — |
| T1571 | Non-Standard Port | — |
| T1583 | Acquire Infrastructure | — |
| T1583.001 | Domains | — |
| T1583.004 | Server | — |
| T1584.004 | Server | — |
| T1584.005 | Botnet | — |
| T1585.001 | Social Media Accounts | — |
| T1585.002 | Email Accounts | — |
| T1586.001 | Social Media Accounts | — |
| T1587.001 | Malware | — |
| T1588.002 | Tool | — |
| T1588.006 | Vulnerabilities | — |
| T1589.002 | Email Addresses | — |
| T1589.003 | Employee Names | — |
| T1590.001 | Domain Properties | — |
| T1591.002 | Business Relationships | — |
| T1592.002 | Software | — |
| T1593 | Search Open Websites/Domains | — |
| T1594 | Search Victim-Owned Websites | — |
| T1595.002 | Vulnerability Scanning | — |
| T1598.003 | Spearphishing Link | — |
| T1608.001 | Upload Malware | — |
Aliases
APT44 · BlackEnergy (Group) · ELECTRUM · FROZENBARENTS · IRIDIUM · IRON VIKING · Quedagh · Sandworm Team · Seashell Blizzard · Telebots · Voodoo Bear · 镭眼
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.