Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.12 This group has been active since at least 2009.3456 In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.78 Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.9
- US District Court Indictment GRU Unit 74455 October 2020
- UK NCSC Olympic Attacks October 2020
- iSIGHT Sandworm 2014
- CrowdStrike VOODOO BEAR
- USDOJ Sandworm Feb 2020
- NCSC Sandworm Feb 2020
- US District Court Indictment GRU Unit 74455 October 2020
- UK NCSC Olympic Attacks October 2020
- US District Court Indictment GRU Oct 2018
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1608.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1040 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1539 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1072 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1106 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1489 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1499 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1561.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1592.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1491.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1594 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1490 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1485 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1593 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1018 | Remote System Discovery | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1027 | Obfuscated Files or Information | — |
| T1027.010 | Command Obfuscation | — |
| T1033 | System Owner/User Discovery | — |
| T1036 | Masquerading | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1040 | Network Sniffing | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1056.001 | Keylogging | — |
| T1059.001 | PowerShell | — |
| T1059.005 | Visual Basic | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1072 | Software Deployment Tools | — |
| T1078 | Valid Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087.002 | Domain Account | — |
| T1087.003 | Email Account | — |
| T1090 | Proxy | — |
| T1102.002 | Bidirectional Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1106 | Native API | — |
| T1132.001 | Standard Encoding | — |
| T1133 | External Remote Services | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1195 | Supply Chain Compromise | — |
| T1195.002 | Compromise Software Supply Chain | — |
| T1199 | Trusted Relationship | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1213.006 | Databases | — |
| T1218.011 | Rundll32 | — |
| T1219 | Remote Access Tools | — |
| T1485 | Data Destruction | — |
| T1486 | Data Encrypted for Impact | — |
| T1489 | Service Stop | — |
| T1490 | Inhibit System Recovery | — |
| T1491.002 | External Defacement | — |
| T1499 | Endpoint Denial of Service | — |
| T1505.003 | Web Shell | — |
| T1539 | Steal Web Session Cookie | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1561.002 | Disk Structure Wipe | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1570 | Lateral Tool Transfer | — |
| T1571 | Non-Standard Port | — |
| T1583 | Acquire Infrastructure | — |
| T1583.001 | Domains | — |
| T1583.004 | Server | — |
| T1584.004 | Server | — |
| T1584.005 | Botnet | — |
| T1585.001 | Social Media Accounts | — |
| T1585.002 | Email Accounts | — |
| T1586.001 | Social Media Accounts | — |
| T1587.001 | Malware | — |
| T1588.002 | Tool | — |
| T1588.006 | Vulnerabilities | — |
| T1589.002 | Email Addresses | — |
| T1589.003 | Employee Names | — |
| T1590.001 | Domain Properties | — |
| T1591.002 | Business Relationships | — |
| T1592.002 | Software | — |
| T1593 | Search Open Websites/Domains | — |
| T1594 | Search Victim-Owned Websites | — |
| T1595.002 | Vulnerability Scanning | — |
| T1598.003 | Spearphishing Link | — |
| T1608.001 | Upload Malware | — |
别名
APT44 · BlackEnergy (Group) · ELECTRUM · FROZENBARENTS · IRIDIUM · IRON VIKING · Quedagh · Sandworm Team · Seashell Blizzard · Telebots · Voodoo Bear · 镭眼
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。