Sandworm Team

Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove

Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised syste

Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s bu

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compro

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web bro

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and networ

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-serv

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large n

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their propert

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address li

Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their op

Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email

Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide oth

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be perfor

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications chan

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or us

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

AcidPour is a variant of AcidRain designed to impact a wider ran

AcidRain is an ELF binary targeting modems and routers using MIPS architecture.(Citation: AcidRain JAGS 202

Bad Rabbit is a self-propagating ransomware that affected the Ukrainian transportation sector in 2017. [Bad

BlackEnergy is a malware toolkit that has been used by both criminal and APT actors. It dates back to at le

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

Cyclops Blink is a modular malware that has been used in widespread campaigns by [Sandworm Team](https://at

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publ

Exaramel for Linux is a backdoor written in the Go Programming Language and compiled as a 64-bit ELF binary

Exaramel for Windows is a backdoor used for targeting Windows systems. The Linux version is tracked separat

GreyEnergy is a backdoor written in C and compiled in Visual Studio. [GreyEnergy](https://attack.mitre.org/

Impacket is an open source collection of modules written in Python for programmatically constructing and ma

Industroyer is a sophisticated malware framework designed to cause an impact to the working processes of In

Industroyer2 is a compiled and static piece of malware that has the ability to communicate over the IEC-104

Invoke-PSImage takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image.

Kapeka is a backdoor written in C++ used against victims in Eastern Europe since at least mid-2022. Kapeka has technical overlaps with [Exaramel for W

KillDisk is a disk-wiping tool designed to overwrite files with random data to render the OS unbootable. It

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

Neo-reGeorg is an open-source web shell designed as a restructuring of [reGeorg](https://attack.mitre.org/s

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

NotPetya is malware that was used by Sandworm Team in a worldwide

Olympic Destroyer is malware that was used by Sandworm Team agains

P.A.S. Webshell is a publicly available multifunctional PHP webshell in use since at least 2016 that provid

PoshC2 is an open source remote administration and post-exploitation framework that is publicly available o

Prestige ransomware has been used by Sandworm Team since at least

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

SDelete is an application that securely deletes data in a way that makes it unrecoverable. It is part of th

VPNFilter is a multi-stage, modular platform with versatile capabilities to support both intelligence-colle

2015 Ukraine Electric Power Attack was a Sandworm Team campaign d

2016 Ukraine Electric Power Attack was a Sandworm Team campaign d

The 2022 Ukraine Electric Power Attack was a Sandworm Team campai