- Category
- State · Attributed to a state or working for one.
- Origin
- Russia(high confidence)contested
- Sponsor
- State-sponsored, GRU Unit 74455
- Agency named
- GRU, Unit 26165, Unit 74455
- Motivation
- Espionage; Information theft and espionage; Sabotage and destruction
- Seen
- 2009–2026
- Status
- Active
- ATT&CK
- G0034 · 86 techniques
- Sources
- 12 sources carry it
- Identifier
- GINC-APT-0032 · sandworm-team
RussiaWhat it is
Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455. This group has been active since at least 2009.
In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019. Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CERT-UA
- UAC-0082, UAC-0113, UAC-0125, UAC-0133, UAC-0145
- CrowdStrike
- Sandworm Team, Iron Viking, Voodoo Bear, Voodoo Bear
- Mandiant
- APT 44, APT44, TEMP.Noble
- Microsoft
- Seashell Blizzard
- MITRE ATT&CK
- G0034
- PwC
- Blue Echidna
- Qihoo 360
- APT-C-13
- Secureworks
- CTG-7263, IRON VIKING
- Other names
- IRIDIUM, Sandworm, TeleBots, ATK 14, BE2, BlackEnergy (Group), BlackEnergy Lite, ELECTRUM, FROZENBARENTS, Grey Tornado, PHANTOM, Quedagh, Razing Ursa, SANDWORM RELIC
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- ETDA / ThaiCERTRussia
- MISP Galaxy (CFR tagging)Russia
- MISP Galaxy (CFR tagging)Iran
- MicrosoftRussia
- ThreatActor.info (Malpedia et al.)Russia · high
Chinese and Russian sources
- Qihoo 360Russia
Targets
- Countries
- Afghanistan, Angola, Argentina, Australia, Austria, Azerbaijan, Belarus, Belgium, Bulgaria, Cambodia, Canada, China, Colombia, Czech, Denmark, Egypt, France, Georgia, Germany, Ghana, Hungary, India, Iran, Israel, Italy, Kazakhstan, Kyrgyzstan, Latvia, Lithuania, Luxembourg, Moldova, Myanmar, Netherlands, Nigeria, Norway, Oman, Pakistan, Paraguay, Peru, Poland, Portugal, Romania, Russia, Serbia, South Korea, Spain, Sweden, Syria, Thailand, Türkiye, Ukraine, United Kingdom, United States, Uzbekistan, Vietnam
- Sectors
- Education, Electric, Energy, Financial, Government, Industrial, Oil and gas, Private sector, Technology, Telecommunications, Transportation
Tools
The tools and malware families the sources tie to it.
- AcidPour
- AcidRain
- BLACKCOFFEE
- Bad Rabbit
- BlackEnergy
- BlackHole
- BlackNix
- Blackshades
- CHEMISTGAMES
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- Cyclops Blink
- Empire
- Exaramel for Linux
- Exaramel for Windows
- GreyEnergy
- Impacket
- Industroyer
- Industroyer2
- Invoke-PSImage
- Kapeka
- KillDisk
- Mimikatz
- Neo-reGeorg
- Net
- NotPetya
- Olympic Destroyer
- P.A.S. Webshell
- POWERSOURCE
- POWERSTATS
- PoshC2
- Power Loader
- PowerDuke
- PowerRAT
- Prestige
- PsExec
- SDelete
- VPNFilter
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net