Threat Actor: Sandworm Team
Sandworm Team is classified as an advanced Nation-State APT originating primarily from Russia (GRU Main Intelligence Directorate, Unit 74455). Driven by operational objectives spanning geopolitical sabotage, kinetic-impact cyberattacks & wartime disruption, this threat entity has maintained an active footprint from 2009 - Present. In enterprise telemetry and malware repository classification, Sandworm Team has been corroborated across 3 distinct malware families with over 123 validated sample hashes.
Operational Threat Profile & Targeting
| Known Aliases | TeleBots, Voodoo Bear, Iron Viking, BlackEnergy Group, Electrum, Seashell Blizzard |
|---|---|
| Targeted Sectors | Electrical Energy Grids, Ukrainian Critical Infrastructure, Government Ministries, Railway Systems, Media Outlets |
| Primary Motivations | Geopolitical Sabotage, Kinetic-Impact Cyberattacks & Wartime Disruption |
| Dominant Payload Categories | Advanced Threat · Wiper · Ransomware |
| MITRE ATT&CK Reference | https://attack.mitre.org/groups/G0034/ ↗ |
Primary Observed MITRE ATT&CK Tradecraft
The following offensive techniques have been empirically verified across implants and campaign tooling weaponized by Sandworm Team:
T1059.003— weaponized across 2 catalog payload(s)T1561.002— weaponized across 2 catalog payload(s)T1490— weaponized across 2 catalog payload(s)T1055— weaponized across 1 catalog payload(s)T1562.001— weaponized across 1 catalog payload(s)T1485— weaponized across 1 catalog payload(s)T1071.001— weaponized across 1 catalog payload(s)T1082— weaponized across 1 catalog payload(s)T1561.001— weaponized across 1 catalog payload(s)T1070.001— weaponized across 1 catalog payload(s)T1078.002— weaponized across 1 catalog payload(s)T1047— weaponized across 1 catalog payload(s)T1569.002— weaponized across 1 catalog payload(s)T1210— weaponized across 1 catalog payload(s)T1003.001— weaponized across 1 catalog payload(s)T1021.002— weaponized across 1 catalog payload(s)
Exploited Vulnerabilities (CVEs)
Telemetry confirms Sandworm Team has actively weaponized the following Common Vulnerabilities and Exposures in enterprise intrusions:
- CVE-2014-4114 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-0144 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-0145 — Technical Dossier & Exploitation Analysis (NVD ↗)
Attributed Catalog Malware Families (3 Families)
The following malware implants in the SystemHelpDesk catalog have been verified in operational campaigns attributed to Sandworm Team:
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| petya | Ransomware | 121 | Petya is one of the most historically destructive malware architectures ever deployed. Originally developed in early 2016 as a commercial ransomware strain by a... |
| blackenergy | Advanced Threat | 1 | BlackEnergy is an advanced, modular persistent threat (APT) framework originally authored in 2007 by Ukrainian hacker Dmytro Oleksiuk (alias 'Cr4sh') as an unde... |
| killdisk | Wiper | 1 | Trojan:Win32/KillDisk is a catastrophic industrial wiper malware family developed and deployed by Russian military intelligence hackers belonging to the Russian... |
Official US Federal & CISA Advisories
Official intelligence alerts and joint cybersecurity advisories published regarding Sandworm Team operations:
SOC Hardening & Defensive Containment
Defending enterprise perimeters against campaigns staged by Sandworm Team requires defense-in-depth posture enforcement:
- Egress Filtering & C2 Interception: Enforce strict egress inspection and block communication to unclassified external IP blocks, fast-flux proxy relays, and dynamic DNS providers.
- Credential Isolation & Privileged Access Management: Enforce FIDO2 hardware MFA across all administrative and VPN entry points to prevent session token hijacking and password reuse.
- Attack Surface Reduction & Patch Velocity: Prioritize remediation of public-facing edge network appliances (VPN concentrators, web servers, file transfer appliances).