Nation-stateDisruptionEspionageATT&CK G0034

Sandworm Team

Also known as: APT44, Seashell Blizzard, Voodoo Bear, IRIDIUM, ELECTRUM, Telebots

Sandworm is the group most associated with destructive cyber attacks. It caused the first publicly confirmed power outages from a cyber attack in Ukraine and released NotPetya, a wiper disguised as ransomware that spread worldwide and caused billions of dollars in damage. Its operations combine espionage, sabotage and information operations.

Public attribution: Publicly attributed by the US government to Russia's military intelligence service (GRU), Main Center for Special Technologies, military unit 74455; six officers were indicted in October 2020.
Active since: Around 2009
Targets: Ukrainian energy, government and media organisations
Critical infrastructure and industrial control systems
Elections and international events
Organisations worldwide caught by self-spreading destructive malware

Notable campaigns

2015-2016Ukrainian power grid attacks
Attacks on Ukrainian electricity companies caused power outages in two consecutive winters.
2017NotPetya
A destructive worm spread first through a compromised update of the Ukrainian accounting software M.E.Doc and then worldwide.
2018Olympic Destroyer
Destructive malware disrupted IT systems during the opening ceremony of the Pyeongchang Winter Olympics.
2020US indictment of GRU officers
The US charged six Unit 74455 officers over the Ukraine grid attacks, NotPetya, Olympic Destroyer and other operations.

Signature ATT&CK techniques

Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.

Defences that work against this actor

Keep offline, immutable backups and rehearse full rebuilds; against a wiper, restore speed is the real control.
Segment IT from OT networks and control remote access into industrial environments tightly.
Protect domain controllers and Group Policy as tier 0 assets, and alert on unexpected GPO changes that push scheduled tasks or binaries.
Validate software updates from suppliers and restrict what update services can reach.
Patch internet-facing systems and network edge devices promptly.

Learn and practise on CyberCertPrep

OT security lab Ransomware triage lab Glossary: supply chain attack

Sources

Notable campaigns

2015-2016Ukrainian power grid attacks

Attacks on Ukrainian electricity companies caused power outages in two consecutive winters.

2017NotPetya

A destructive worm spread first through a compromised update of the Ukrainian accounting software M.E.Doc and then worldwide.

2018Olympic Destroyer

Destructive malware disrupted IT systems during the opening ceremony of the Pyeongchang Winter Olympics.

2020US indictment of GRU officers

The US charged six Unit 74455 officers over the Ukraine grid attacks, NotPetya, Olympic Destroyer and other operations.

Defences that work against this actor

Keep offline, immutable backups and rehearse full rebuilds; against a wiper, restore speed is the real control.

Segment IT from OT networks and control remote access into industrial environments tightly.

Protect domain controllers and Group Policy as tier 0 assets, and alert on unexpected GPO changes that push scheduled tasks or binaries.

Validate software updates from suppliers and restrict what update services can reach.

Patch internet-facing systems and network edge devices promptly.