Sandworm
threat actorRUalso known as
Other names and identifiers for this entity.
ATT&CK
APT44 · BlackEnergy (Group) · ELECTRUM · FROZENBARENTS · IRIDIUM · IRON VIKING · Quedagh · Sandworm Team · Seashell Blizzard · Telebots · Voodoo Bear
MISP
APT44 · Blue Echidna · ELECTRUM · FROZENBARENTS · IRIDIUM · IRON VIKING · Quedagh · SANDWORM RELIC · Sandworm · Seashell Blizzard · TEMP.Noble · TeleBots · UAC-0082 · UAC-0113 · UAC-0145 · VOODOO BEAR
This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes. Some believe that the threat actor is linked to the 2015 compromise of the Ukrainian electrical grid and a distributed denial of service prior to the Russian invasion of Georgia. Believed to be responsible for the 2008 DDoS attacks in Georgia and the 2015 Ukraine power grid outage
resolved ATT&CK groups
Threat groups associated with this.
related actors
Related entries.
- GreyEnergy· likely
techniques used (86)
ATT&CK techniques this enables or maps to.
campaigns (3)
Campaigns that use this.
software used (28)
Malware and tools associated with this.
references
External citations — patches, advisories, analysis.
- https://dragos.com/blog/crashoverride/CrashOverride-01.pdf
- https://www.us-cert.gov/ncas/alerts/TA17-163A
- https://ics.sans.org/blog/2016/01/09/confirmation-of-a-coordinated-attack-on-the-ukrainian-power-grid
- https://web.archive.org/web/20141016132823/https://www.symantec.com/connect/blogs/sandworm-windows-zero-day-vulnerability-being-actively-exploited-targeted-attacks
- https://ics.sans.org/blog/2015/12/30/current-reporting-on-the-cyber-attack-in-ukraine-resulting-in-power-outage
- https://web.archive.org/web/20141224060545/http://blog.trendmicro.com/trendlabs-security-intelligence/timeline-of-sandworm-attacks/
- https://attack.mitre.org/groups/G0034
- https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag