CVE Intelligence
Home / Threat actors / Sandworm Team

Sandworm Team G0034

🔔 Create alert

Also known as: ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group), Quedagh, Voodoo Bear, IRIDIUM, Seashell Blizzard, FROZENBARENTS, APT44

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

2
associated CVEs
91
Techniques
27
Malware and tools

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455. This group has been active since at least 2009.

In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019. Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.

Ransomware operations linked to this group ransomware.live

NotPetya via NotPetya

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2014-4114 High · 7.8 KEV Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability
“Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).”
CVE-2013-3906 High · 7.8 KEV Microsoft Graphics Component Memory Corruption Vulnerability
“Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).”

Techniques by tactic

Reconnaissance
T1589.002 Email AddressesT1589.003 Employee NamesT1590.001 Domain PropertiesT1591.002 Business RelationshipsT1592.002 SoftwareT1593 Search Open Websites/DomainsT1594 Search Victim-Owned WebsitesT1595.002 Vulnerability ScanningT1598.003 Spearphishing Link
Resource Development
T1583 Acquire InfrastructureT1583.001 DomainsT1583.004 ServerT1584.004 ServerT1584.005 BotnetT1585.001 Social Media AccountsT1585.002 Email AccountsT1586.001 Social Media AccountsT1587.001 MalwareT1588.002 ToolT1588.006 VulnerabilitiesT1608.001 Upload Malware
Initial Access
T1078 Valid AccountsT1078.002 Domain AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1195.002 Compromise Software Supply ChainT1199 Trusted RelationshipT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.005 Visual BasicT1072 Software Deployment ToolsT1106 Native APIT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious File
Persistence
T1053.005 Scheduled TaskT1078 Valid AccountsT1078.002 Domain AccountsT1133 External Remote ServicesT1505.003 Web Shell
Privilege Escalation
T1053.005 Scheduled TaskT1078 Valid AccountsT1078.002 Domain Accounts
Stealth
T1027 Obfuscated Files or InformationT1027.010 Command ObfuscationT1036 MasqueradingT1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1078 Valid AccountsT1078.002 Domain AccountsT1140 Deobfuscate/Decode Files or InformationT1218.011 Rundll32
Credential Access
T1003.001 LSASS MemoryT1003.003 NTDST1040 Network SniffingT1056.001 KeyloggingT1539 Steal Web Session CookieT1555.003 Credentials from Web Browsers
Discovery
T1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1040 Network SniffingT1049 System Network Connections DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.002 Domain AccountT1087.003 Email Account
Lateral Movement
T1021.002 SMB/Windows Admin SharesT1072 Software Deployment ToolsT1570 Lateral Tool Transfer
Collection
T1005 Data from Local SystemT1056.001 KeyloggingT1213.006 Databases
Command and Control
T1071.001 Web ProtocolsT1090 ProxyT1102.002 Bidirectional CommunicationT1105 Ingress Tool TransferT1132.001 Standard EncodingT1219 Remote Access ToolsT1571 Non-Standard Port
Exfiltration
T1041 Exfiltration Over C2 Channel
Impact
T1485 Data DestructionT1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System RecoveryT1491.002 External DefacementT1499 Endpoint Denial of ServiceT1561.002 Disk Structure Wipe

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.