Sandworm
BedrohungsakteurRUauch bekannt als
Weitere Namen und Kennungen dieser Entität.
ATT&CK
APT44 · BlackEnergy (Group) · ELECTRUM · FROZENBARENTS · IRIDIUM · IRON VIKING · Quedagh · Sandworm Team · Seashell Blizzard · Telebots · Voodoo Bear
MISP
APT44 · Blue Echidna · ELECTRUM · FROZENBARENTS · IRIDIUM · IRON VIKING · Quedagh · SANDWORM RELIC · Sandworm · Seashell Blizzard · TEMP.Noble · TeleBots · UAC-0082 · UAC-0113 · UAC-0145 · VOODOO BEAR
This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes. Some believe that the threat actor is linked to the 2015 compromise of the Ukrainian electrical grid and a distributed denial of service prior to the Russian invasion of Georgia. Believed to be responsible for the 2008 DDoS attacks in Georgia and the 2015 Ukraine power grid outage
zugeordnete ATT&CK-Gruppen
Zugehörige Bedrohungsgruppen.
verwandte Akteure
Verwandte Einträge.
- GreyEnergy· likely
genutzte Techniken (86)
ATT&CK-Techniken, die dies ermöglicht oder abbildet.
Kampagnen (3)
Kampagnen, die dies verwenden.
genutzte Software (28)
Zugehörige Malware und Tools.
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://dragos.com/blog/crashoverride/CrashOverride-01.pdf
- https://www.us-cert.gov/ncas/alerts/TA17-163A
- https://ics.sans.org/blog/2016/01/09/confirmation-of-a-coordinated-attack-on-the-ukrainian-power-grid
- https://web.archive.org/web/20141016132823/https://www.symantec.com/connect/blogs/sandworm-windows-zero-day-vulnerability-being-actively-exploited-targeted-attacks
- https://ics.sans.org/blog/2015/12/30/current-reporting-on-the-cyber-attack-in-ukraine-resulting-in-power-outage
- https://web.archive.org/web/20141224060545/http://blog.trendmicro.com/trendlabs-security-intelligence/timeline-of-sandworm-attacks/
- https://attack.mitre.org/groups/G0034
- https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag