CVE Intelligence
Início / Grupos de ameaça / Sandworm Team

Sandworm Team G0034

🔔 Criar alerta

Também conhecido como: ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group), Quedagh, Voodoo Bear, IRIDIUM, Seashell Blizzard, FROZENBARENTS, APT44

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

2
CVEs associadas
91
Técnicas
27
Malwares e ferramentas

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455. This group has been active since at least 2009.

In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019. Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.

Operações de ransomware ligadas a este grupo ransomware.live

NotPetya via NotPetya

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2014-4114 Alta · 7.8 KEV Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability
“Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).”
CVE-2013-3906 Alta · 7.8 KEV Microsoft Graphics Component Memory Corruption Vulnerability
“Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).”

Técnicas por tática

Reconhecimento
T1589.002 Email AddressesT1589.003 Employee NamesT1590.001 Domain PropertiesT1591.002 Business RelationshipsT1592.002 SoftwareT1593 Search Open Websites/DomainsT1594 Search Victim-Owned WebsitesT1595.002 Vulnerability ScanningT1598.003 Spearphishing Link
Desenvolvimento de recursos
T1583 Acquire InfrastructureT1583.001 DomainsT1583.004 ServerT1584.004 ServerT1584.005 BotnetT1585.001 Social Media AccountsT1585.002 Email AccountsT1586.001 Social Media AccountsT1587.001 MalwareT1588.002 ToolT1588.006 VulnerabilitiesT1608.001 Upload Malware
Acesso inicial
T1078 Valid AccountsT1078.002 Domain AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1195.002 Compromise Software Supply ChainT1199 Trusted RelationshipT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execução
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.005 Visual BasicT1072 Software Deployment ToolsT1106 Native APIT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious File
Persistência
T1053.005 Scheduled TaskT1078 Valid AccountsT1078.002 Domain AccountsT1133 External Remote ServicesT1505.003 Web Shell
Escalada de privilégios
T1053.005 Scheduled TaskT1078 Valid AccountsT1078.002 Domain Accounts
Furtividade
T1027 Obfuscated Files or InformationT1027.010 Command ObfuscationT1036 MasqueradingT1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1078 Valid AccountsT1078.002 Domain AccountsT1140 Deobfuscate/Decode Files or InformationT1218.011 Rundll32
Acesso a credenciais
T1003.001 LSASS MemoryT1003.003 NTDST1040 Network SniffingT1056.001 KeyloggingT1539 Steal Web Session CookieT1555.003 Credentials from Web Browsers
Descoberta
T1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1040 Network SniffingT1049 System Network Connections DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.002 Domain AccountT1087.003 Email Account
Movimento lateral
T1021.002 SMB/Windows Admin SharesT1072 Software Deployment ToolsT1570 Lateral Tool Transfer
Coleta
T1005 Data from Local SystemT1056.001 KeyloggingT1213.006 Databases
Comando e controle
T1071.001 Web ProtocolsT1090 ProxyT1102.002 Bidirectional CommunicationT1105 Ingress Tool TransferT1132.001 Standard EncodingT1219 Remote Access ToolsT1571 Non-Standard Port
Exfiltração
T1041 Exfiltration Over C2 Channel
Impacto
T1485 Data DestructionT1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System RecoveryT1491.002 External DefacementT1499 Endpoint Denial of ServiceT1561.002 Disk Structure Wipe

Malwares e ferramentas

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.