Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Преступная группа Sandworm Team
Риски
Каталоги
MITRE ATT&CK
Преступная группа
Sandworm Team
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Sandworm Team

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020) In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.(Citation: US District Court Indictment GRU Oct 2018)
ID: G0034
Associated Groups: Telebots, Quedagh, ELECTRUM, FROZENBARENTS, APT44, IRON VIKING, Voodoo Bear, BlackEnergy (Group), Seashell Blizzard, IRIDIUM
Version: 4.2
Created: 31 May 2017
Last Modified: 04 Dec 2024

Associated Group Descriptions
Name Description
Telebots (Citation: NCSC Sandworm Feb 2020)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)
Quedagh (Citation: iSIGHT Sandworm 2014) (Citation: F-Secure BlackEnergy 2014)(Citation: UK NCSC Olympic Attacks October 2020)
ELECTRUM (Citation: Dragos ELECTRUM)(Citation: UK NCSC Olympic Attacks October 2020)
FROZENBARENTS (Citation: Leonard TAG 2023)
APT44 (Citation: mandiant_apt44_unearthing_sandworm)
IRON VIKING (Citation: Secureworks IRON VIKING )(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)
Voodoo Bear (Citation: CrowdStrike VOODOO BEAR)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)
BlackEnergy (Group) (Citation: NCSC Sandworm Feb 2020)(Citation: UK NCSC Olympic Attacks October 2020)
Seashell Blizzard (Citation: Microsoft Threat Actor Naming July 2023)
IRIDIUM (Citation: Microsoft Prestige ransomware October 2022)

Techniques Used
Domain ID Name Use
Enterprise T1087 .002 Account Discovery: Domain Account

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.(Citation: ESET Telebots Dec 2016)

.003 Account Discovery: Email Account

Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.(Citation: ESET Telebots July 2017)

Enterprise T1583 .001 Acquire Infrastructure: Domains

Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages, while also hosting these items on legitimate, compromised network infrastructure.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Slowik Sandworm 2021)
.004 Acquire Infrastructure: Server

Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.(Citation: US District Court Indictment GRU Unit 74455 October 2020)

Enterprise T1595 .002 Active Scanning: Vulnerability Scanning

Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.(Citation: ESET Telebots Dec 2016)

Enterprise T1110 .003 Brute Force: Password Spraying

Sandworm Team has used a script to attempt RPC authentication against a number of hosts.(Citation: Dragos Crashoverride 2018)

Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Dragos Crashoverride 2018)

.003 Command and Scripting Interpreter: Windows Command Shell

Sandworm Team has run the xp_cmdshell command in MS-SQL.(Citation: Dragos Crashoverride 2018)

.005 Command and Scripting Interpreter: Visual Basic

Sandworm Team has created VBScripts to run an SSH server.(Citation: ESET BlackEnergy Jan 2016)(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)(Citation: Dragos Crashoverride 2018)

Enterprise T1586 .001 Compromise Accounts: Social Media Accounts

Sandworm Team creates credential capture webpages to compromise existing, legitimate social media accounts.(Citation: Slowik Sandworm 2021)
Enterprise T1584 .004 Compromise Infrastructure: Server

Sandworm Team compromised legitimate Linux servers running the EXIM mail transfer agent for use in subsequent campaigns.(Citation: NSA Sandworm 2020)(Citation: Leonard TAG 2023)
.005 Compromise Infrastructure: Botnet

Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.(Citation: NCSC Cyclops Blink February 2022)

Enterprise T1136 .002 Create Account: Domain Account

Sandworm Team has created new domain accounts on an ICS access server.(Citation: Dragos Crashoverride 2018)
Enterprise T1555 .003 Credentials from Password Stores: Credentials from Web Browsers

Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.(Citation: ESET Telebots Dec 2016)
Enterprise T1132 .001 Data Encoding: Standard Encoding

Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.(Citation: ESET Telebots Dec 2016)

Enterprise T1491 .002 Defacement: External Defacement

Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)
Enterprise T1587 .001 Develop Capabilities: Malware

Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Enterprise T1561 .002 Disk Wipe: Disk Structure Wipe

Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.(Citation: US-CERT Ukraine Feb 2016)(Citation: ESET Telebots June 2017)
Enterprise T1585 .001 Establish Accounts: Social Media Accounts

Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
.002 Establish Accounts: Email Accounts

Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.(Citation: US District Court Indictment GRU Unit 74455 October 2020)

Enterprise T1592 .002 Gather Victim Host Information: Software

Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Enterprise T1589 .002 Gather Victim Identity Information: Email Addresses

Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
.003 Gather Victim Identity Information: Employee Names

Sandworm Team's research of potential victim organizations included the identification and collection of employee information.(Citation: US District Court Indictment GRU Unit 74455 October 2020)

Enterprise T1590 .001 Gather Victim Network Information: Domain Properties

Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Enterprise T1591 .002 Gather Victim Org Information: Business Relationships

In preparation for its attack against the 2018 Winter Olympics, Sandworm Team conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Enterprise T1562 .002 Impair Defenses: Disable Windows Event Logging

Sandworm Team has disabled event logging on compromised systems.(Citation: Dragos Crashoverride 2018)
Enterprise T1070 .004 Indicator Removal: File Deletion

Sandworm Team has used backdoors that can delete files used in an attack from an infected system.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots July 2017)(Citation: Mandiant-Sandworm-Ukraine-2022)

Enterprise T1056 .001 Input Capture: Keylogging

Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.(Citation: ESET Telebots Dec 2016)

Enterprise T1036 .005 Masquerading: Match Legitimate Resource Name or Location

Sandworm Team has avoided detection by naming a malicious binary explorer.exe.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Enterprise T1003 .001 OS Credential Dumping: LSASS Memory

Sandworm Team has used its plainpwd tool, a modified version of Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)(Citation: Microsoft Prestige ransomware October 2022)

.003 OS Credential Dumping: NTDS

Sandworm Team has used `ntdsutil.exe` to back up the Active Directory database, likely for credential access.(Citation: Microsoft Prestige ransomware October 2022)

Enterprise T1027 .002 Obfuscated Files or Information: Software Packing

Sandworm Team used UPX to pack a copy of Mimikatz.(Citation: Dragos Crashoverride 2018)

.010 Obfuscated Files or Information: Command Obfuscation

Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.(Citation: ESET Telebots Dec 2016)

Enterprise T1588 .002 Obtain Capabilities: Tool

Sandworm Team has acquired open-source tools for their operations, including Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as Impacket and RemoteExec, which were used in their 2022 Prestige operations.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Microsoft Prestige ransomware October 2022) Additionally, Sandworm Team has used Empire, Cobalt Strike and PoshC2.(Citation: mandiant_apt44_unearthing_sandworm)
.006 Obtain Capabilities: Vulnerabilities

In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.(Citation: US District Court Indictment GRU Unit 74455 October 2020)

Enterprise T1566 .001 Phishing: Spearphishing Attachment

Sandworm Team has delivered malicious Microsoft Office and ZIP file attachments via spearphishing emails.(Citation: iSight Sandworm Oct 2014)(Citation: US-CERT Ukraine Feb 2016)(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Google_WinRAR_vuln_2023)(Citation: mandiant_apt44_unearthing_sandworm)
.002 Phishing: Spearphishing Link

Sandworm Team has crafted phishing emails containing malicious hyperlinks.(Citation: US District Court Indictment GRU Unit 74455 October 2020)

Enterprise T1598 .003 Phishing for Information: Spearphishing Link

Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Enterprise T1021 .002 Remote Services: SMB/Windows Admin Shares

Sandworm Team has copied payloads to the `ADMIN$` share of remote systems and run net use to connect to network shares.(Citation: Dragos Crashoverride 2018)(Citation: Microsoft Prestige ransomware October 2022)
Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

Sandworm Team leveraged SHARPIVORY, a .NET dropper that writes embedded payload to disk and uses scheduled tasks to persist on victim machines.(Citation: mandiant_apt44_unearthing_sandworm)
Enterprise T1505 .001 Server Software Component: SQL Stored Procedures

Sandworm Team has used various MS-SQL stored procedures.(Citation: Dragos Crashoverride 2018)

.003 Server Software Component: Web Shell

Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.(Citation: ANSSI Sandworm January 2021)

Enterprise T1608 .001 Stage Capabilities: Upload Malware

Sandworm Team staged compromised versions of legitimate software installers in forums to enable initial access to executing user.(Citation: mandiant_apt44_unearthing_sandworm)
Enterprise T1195 .002 Supply Chain Compromise: Compromise Software Supply Chain

Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.(Citation: Secureworks NotPetya June 2017)(Citation: ESET Telebots June 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Enterprise T1218 .011 System Binary Proxy Execution: Rundll32

Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.(Citation: ESET Telebots July 2017)

Enterprise T1204 .001 User Execution: Malicious Link

Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
.002 User Execution: Malicious File

Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)

Enterprise T1078 .002 Valid Accounts: Domain Accounts

Sandworm Team has used stolen credentials to access administrative accounts within the domain.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Microsoft Prestige ransomware October 2022)
Enterprise T1102 .002 Web Service: Bidirectional Communication

Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor. Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)

Software
ID Name References Techniques
S0039 Net (Citation: Dragos Crashoverride 2018) (Citation: Microsoft Net Utility) (Citation: Savill 1999) Domain Account, Local Account, Domain Groups, System Service Discovery, Network Share Discovery, Additional Local or Domain Groups, SMB/Windows Admin Shares, Local Account, Domain Account, System Network Connections Discovery, Local Groups, Network Share Connection Removal, Password Policy Discovery, Remote System Discovery, Service Execution, System Time Discovery
S1125 AcidRain (Citation: AcidRain JAGS 2022) (Citation: AcidRain State Department 2022) (Citation: Vincens AcidPour 2024) File and Directory Discovery, Data Destruction, Disk Content Wipe, System Shutdown/Reboot
S0343 Exaramel for Windows (Citation: ESET TeleBots Oct 2018) Fileless Storage, Local Data Staging, Windows Service, Archive Collected Data, Modify Registry, Masquerade Task or Service, Windows Command Shell, Visual Basic
S0401 Exaramel for Linux (Citation: ANSSI Sandworm January 2021) (Citation: ESET TeleBots Oct 2018) System Owner/User Discovery, Encrypted/Encoded File, Create or Modify System Process, Cron, Deobfuscate/Decode Files or Information, Setuid and Setgid, Unix Shell, File Deletion, Web Protocols, Systemd Service, Ingress Tool Transfer, Fallback Channels
S1058 Prestige (Citation: Microsoft Prestige ransomware October 2022) (Citation: mandiant_apt44_unearthing_sandworm) Scheduled Task, Service Stop, Native API, Modify Registry, Group Policy Modification, File and Directory Discovery, PowerShell, Data Encrypted for Impact, Inhibit System Recovery
S0357 Impacket (Citation: Impacket Tools) (Citation: Microsoft Prestige ransomware October 2022) Windows Management Instrumentation, Security Account Manager, LSA Secrets, Network Sniffing, Ccache Files, LLMNR/NBT-NS Poisoning and SMB Relay, LSASS Memory, Lateral Tool Transfer, NTDS, Service Execution, Kerberoasting
S0606 Bad Rabbit (Citation: Dragos Apr 2019) (Citation: ESET Bad Rabbit) (Citation: Secure List Bad Rabbit) (Citation: Secureworks IRON VIKING ) Scheduled Task, Rundll32, Bypass User Account Control, Match Legitimate Resource Name or Location, Malicious File, Network Share Discovery, Native API, LSASS Memory, Password Spraying, Process Discovery, Exploitation of Remote Services, Data Encrypted for Impact, Drive-by Compromise, Service Execution, Firmware Corruption
S0342 GreyEnergy (Citation: ESET GreyEnergy Oct 2018) (Citation: Secureworks IRON VIKING ) Rundll32, Keylogging, Encrypted/Encoded File, Symmetric Cryptography, Windows Service, System Service Discovery, Code Signing, Modify Registry, LSASS Memory, Portable Executable Injection, Multi-hop Proxy, Asymmetric Cryptography, Windows Command Shell, File Deletion, Software Packing, Web Protocols, Ingress Tool Transfer
S0365 Olympic Destroyer (Citation: CrowdStrike GTR 2019) (Citation: Secureworks IRON VIKING ) (Citation: Talos Olympic Destroyer 2018) (Citation: Trend Micro Cyclops Blink March 2022) (Citation: UK NCSC Olympic Attacks October 2020) (Citation: US District Court Indictment GRU Unit 74455 October 2020) (Citation: mandiant_apt44_unearthing_sandworm) Windows Management Instrumentation, Service Stop, Network Share Discovery, SMB/Windows Admin Shares, Credentials from Web Browsers, Clear Windows Event Logs, LSASS Memory, System Network Configuration Discovery, Lateral Tool Transfer, Data Destruction, Remote System Discovery, Service Execution, Inhibit System Recovery, System Shutdown/Reboot
S0363 Empire (Citation: EmPyre) (Citation: GitHub ATTACK Empire) (Citation: Github PowerShell Empire) (Citation: NCSC Joint Report Public Tools) (Citation: PowerShell Empire) (Citation: mandiant_apt44_unearthing_sandworm) Scheduled Task, Windows Management Instrumentation, Screen Capture, System Owner/User Discovery, Keylogging, Path Interception by PATH Environment Variable, Bypass User Account Control, Group Policy Discovery, Local Email Collection, Domain Account, Local Account, Windows Service, SSH, DLL, Automated Collection, Clipboard Data, Network Sniffing, Network Share Discovery, System Information Discovery, Native API, Process Injection, Timestomp, Shortcut Modification, Security Support Provider, Archive Collected Data, Credentials from Web Browsers, Path Interception by Search Order Hijacking, Group Policy Modification, Browser Information Discovery, Private Keys, Local Account, LLMNR/NBT-NS Poisoning and SMB Relay, LSASS Memory, Create Process with Token, Distributed Component Object Model, Video Capture, System Network Configuration Discovery, Accessibility Features, Command and Scripting Interpreter, Domain Account, Domain Trust Discovery, Golden Ticket, Automated Exfiltration, File and Directory Discovery, System Network Connections Discovery, Credentials In Files, Exfiltration to Code Repository, Process Discovery, Exfiltration Over C2 Channel, PowerShell, Exploitation of Remote Services, Registry Run Keys / Startup Folder, Exploitation for Privilege Escalation, SID-History Injection, Bidirectional Communication, Asymmetric Cryptography, Exfiltration to Cloud Storage, Path Interception by Unquoted Path, MSBuild, Security Software Discovery, Windows Command Shell, Silver Ticket, Command Obfuscation, Access Token Manipulation, Web Protocols, Network Service Discovery, Pass the Hash, Ingress Tool Transfer, Service Execution, Kerberoasting, Credential API Hooking, Commonly Used Port, Dylib Hijacking
S0598 P.A.S. Webshell (Citation: ANSSI Sandworm January 2021) (Citation: Fobushell) (Citation: NCCIC AR-17-20045 February 2017) Linux and Mac File and Directory Permissions Modification, Password Guessing, Local Account, Data from Local System, Deobfuscate/Decode Files or Information, Web Shell, Command and Scripting Interpreter, File and Directory Discovery, Obfuscated Files or Information, Data from Information Repositories, File Deletion, Web Protocols, Network Service Discovery, Software Discovery, Ingress Tool Transfer
S1167 AcidPour (Citation: CERT-UA TelecomAttack 2023) (Citation: SentinelOne AcidPour 2024) Peripheral Device Discovery, System Information Discovery, File and Directory Discovery, Data Destruction, File Deletion, Disk Content Wipe, System Shutdown/Reboot
S0378 PoshC2 (Citation: GitHub PoshC2) (Citation: mandiant_apt44_unearthing_sandworm) Archive via Utility, Windows Management Instrumentation, Keylogging, Bypass User Account Control, Domain Account, Local Account, Automated Collection, System Service Discovery, Network Sniffing, System Information Discovery, Credentials from Password Stores, Process Injection, LLMNR/NBT-NS Poisoning and SMB Relay, LSASS Memory, Create Process with Token, System Network Configuration Discovery, Proxy, Domain Trust Discovery, File and Directory Discovery, System Network Connections Discovery, Credentials In Files, Windows Management Instrumentation Event Subscription, Exploitation of Remote Services, Local Groups, Brute Force, Exploitation for Privilege Escalation, Password Policy Discovery, Access Token Manipulation, Web Protocols, Network Service Discovery, Pass the Hash, Service Execution
S0089 BlackEnergy (Citation: F-Secure BlackEnergy 2014) (Citation: Secureworks IRON VIKING ) (Citation: UK NCSC Olympic Attacks October 2020) (Citation: US District Court Indictment GRU Unit 74455 October 2020) (Citation: iSIGHT Sandworm 2014) Windows Management Instrumentation, Screen Capture, Keylogging, Bypass User Account Control, Windows Service, Peripheral Device Discovery, System Information Discovery, Shortcut Modification, SMB/Windows Admin Shares, Code Signing Policy Modification, Credentials from Web Browsers, Clear Windows Event Logs, System Network Configuration Discovery, Indicator Removal, File and Directory Discovery, System Network Connections Discovery, Credentials In Files, Process Discovery, Services File Permissions Weakness, Registry Run Keys / Startup Folder, Data Destruction, Web Protocols, Network Service Discovery, Fallback Channels, Dynamic-link Library Injection
S0368 NotPetya (Citation: Diskcoder.C) (Citation: ESET Telebots June 2017) (Citation: ExPetr) (Citation: GoldenEye) (Citation: NCSC Sandworm Feb 2020) (Citation: Nyetya) (Citation: Petrwrap) (Citation: Secureworks IRON VIKING ) (Citation: Talos Nyetya June 2017) (Citation: Trend Micro Cyclops Blink March 2022) (Citation: UK NCSC Olympic Attacks October 2020) (Citation: US District Court Indictment GRU Unit 74455 October 2020) (Citation: US-CERT NotPetya 2017) (Citation: mandiant_apt44_unearthing_sandworm) Scheduled Task, Windows Management Instrumentation, Rundll32, Masquerading, SMB/Windows Admin Shares, Clear Windows Event Logs, LSASS Memory, File and Directory Discovery, Exploitation of Remote Services, Data Encrypted for Impact, Security Software Discovery, Service Execution, Local Accounts, System Shutdown/Reboot
S1010 VPNFilter (Citation: Carl Hurd March 2019) (Citation: NCSC CISA Cyclops Blink Advisory February 2022) (Citation: William Largent June 2018) Disk Content Wipe
S1072 Industroyer2 (Citation: Industroyer2 Blackhat ESET) (Citation: Industroyer2 ESET April 2022) (Citation: mandiant_apt44_unearthing_sandworm) Process Discovery
S1190 Kapeka (Citation: KnuckleTouch) (Citation: Microsoft KnuckleTouch 2024) (Citation: WithSecure Kapeka 2024) Scheduled Task, Rundll32, Standard Encoding, Encrypted/Encoded File, Masquerade File Type, System Information Discovery, Native API, Deobfuscate/Decode Files or Information, Modify Registry, Proxy, Query Registry, Windows Command Shell, Clear Persistence, Web Protocols
S0154 Cobalt Strike (Citation: cobaltstrike manual) (Citation: mandiant_apt44_unearthing_sandworm) Windows Management Instrumentation, Screen Capture, Rundll32, Standard Encoding, Keylogging, JavaScript, Bypass User Account Control, Sudo and Sudo Caching, Security Account Manager, DNS, Domain Account, Symmetric Cryptography, Windows Service, Domain Groups, SSH, System Service Discovery, Code Signing, Network Share Discovery, Application Layer Protocol, Native API, Data from Local System, Deobfuscate/Decode Files or Information, Process Injection, Timestomp, Reflective Code Loading, Scheduled Transfer, SMB/Windows Admin Shares, Protocol Tunneling, Browser Session Hijacking, Modify Registry, Windows Remote Management, LSASS Memory, Distributed Component Object Model, System Network Configuration Discovery, Office Template Macros, File and Directory Discovery, System Network Connections Discovery, Token Impersonation/Theft, Make and Impersonate Token, Process Discovery, Parent PID Spoofing, PowerShell, Multiband Communication, File Transfer Protocols, Local Groups, Disable or Modify Tools, Indicator Removal from Tools, Process Hollowing, Exploitation for Privilege Escalation, Obfuscated Files or Information, Exploitation for Client Execution, Asymmetric Cryptography, Non-Application Layer Protocol, Protocol or Service Impersonation, Query Registry, Data Transfer Size Limits, Domain Accounts, BITS Jobs, Domain Fronting, Python, Windows Command Shell, Web Protocols, Visual Basic, Remote System Discovery, Network Service Discovery, Software Discovery, Pass the Hash, Ingress Tool Transfer, Remote Desktop Protocol, Service Execution, Dynamic-link Library Injection, Internal Proxy, Custom Command and Control Protocol, Commonly Used Port, Local Accounts, Process Argument Spoofing
S0002 Mimikatz (Citation: Adsecurity Mimikatz Guide) (Citation: Deply Mimikatz) (Citation: Dragos Crashoverride 2018) Security Account Manager, LSA Secrets, Credentials from Password Stores, Security Support Provider, Rogue Domain Controller, Credentials from Web Browsers, Private Keys, LSASS Memory, Golden Ticket, Pass the Ticket, Steal or Forge Authentication Certificates, Account Manipulation, SID-History Injection, Silver Ticket, Windows Credential Manager, Pass the Hash, DCSync
S0687 Cyclops Blink (Citation: NCSC CISA Cyclops Blink Advisory February 2022) (Citation: NCSC Cyclops Blink February 2022) (Citation: Trend Micro Cyclops Blink March 2022) Match Legitimate Resource Name or Location, System Information Discovery, Native API, Data from Local System, Deobfuscate/Decode Files or Information, Timestomp, Protocol Tunneling, Disable or Modify System Firewall, System Network Configuration Discovery, Component Firmware, File and Directory Discovery, Process Discovery, Exfiltration Over C2 Channel, Multi-hop Proxy, Inter-Process Communication, Non-Standard Port, Asymmetric Cryptography, Non-Standard Encoding, RC Scripts, Web Protocols, Ingress Tool Transfer
S0231 Invoke-PSImage (Citation: GitHub Invoke-PSImage) (Citation: US District Court Indictment GRU Unit 74455 October 2020) Embedded Payloads, Steganography
S1189 Neo-reGeorg (Citation: GitHub Neo-reGeorg 2019) (Citation: Mandiant-Sandworm-Ukraine-2022) Protocol Tunneling, Web Shell, Proxy, Non-Application Layer Protocol, Python, Non-Standard Encoding, Web Protocols, Ingress Tool Transfer
S0195 SDelete (Citation: Microsoft SDelete July 2016) (Citation: mandiant_apt44_unearthing_sandworm) Data Destruction, File Deletion
S0607 KillDisk (Citation: ESEST Black Energy Jan 2016) (Citation: KillDisk Ransomware) (Citation: Secureworks IRON VIKING ) (Citation: Trend Micro KillDisk 1) (Citation: Trend Micro KillDisk 2) (Citation: US District Court Indictment GRU Unit 74455 October 2020) Shared Modules, Disk Structure Wipe, Service Stop, System Information Discovery, Native API, Clear Windows Event Logs, File and Directory Discovery, Masquerade Task or Service, Process Discovery, Obfuscated Files or Information, Data Encrypted for Impact, Data Destruction, File Deletion, Access Token Manipulation, System Shutdown/Reboot
S0604 Industroyer (Citation: CRASHOVERRIDE) (Citation: Dragos Crashoverride 2017) (Citation: Dragos Crashoverride 2018) (Citation: ESET Industroyer) (Citation: Secureworks IRON VIKING) (Citation: Win32/Industroyer) (Citation: mandiant_apt44_unearthing_sandworm) Service Stop, Windows Service, Application or System Exploitation, System Information Discovery, Deobfuscate/Decode Files or Information, Protocol Tunneling, System Network Configuration Discovery, File and Directory Discovery, Exfiltration Over C2 Channel, Compromise Host Software Binary, Multi-hop Proxy, Valid Accounts, Obfuscated Files or Information, Query Registry, Data Destruction, Web Protocols, Remote System Discovery, Network Service Discovery, Ingress Tool Transfer
S0029 PsExec (Citation: Dragos Crashoverride 2018) (Citation: Russinovich Sysinternals) (Citation: SANS PsExec) Windows Service, SMB/Windows Admin Shares, Domain Account, Lateral Tool Transfer, Service Execution

References

  1. ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.
  2. Meyers, A. (2018, January 19). Meet CrowdStrike’s Adversary of the Month for January: VOODOO BEAR. Retrieved May 22, 2018.
  3. Ward, S.. (2014, October 14). iSIGHT discovers zero-day vulnerability CVE-2014-4114 used in Russian cyber-espionage campaign. Retrieved November 17, 2024.
  4. Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.
  5. US-CERT. (2016, February 25). ICS Alert (IR-ALERT-H-16-056-01) Cyber-Attack Against Ukrainian Critical Infrastructure. Retrieved June 10, 2020.
  6. Pompeo, M. (2020, February 20). The United States Condemns Russian Cyber Attack Against the Country of Georgia. Retrieved September 12, 2024.
  7. Hultquist, J.. (2016, January 7). Sandworm Team and the Ukrainian Power Authority Attacks. Retrieved October 6, 2017.
  8. UK NCSC. (2020, October 19). UK exposes series of Russian cyber attacks against Olympic and Paralympic Games . Retrieved November 30, 2020.
  9. Wu, W. (2014, October 14). An Analysis of Windows Zero-day Vulnerability ‘CVE-2014-4114’ aka “Sandworm”. Retrieved June 18, 2020.
  10. Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.
  11. Counter Threat Research Team. (2017, June 28). NotPetya Campaign: What We Know About the Latest Global Ransomware Attack. Retrieved June 11, 2020.
  12. Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020.
  13. Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry . Retrieved June 10, 2020.
  14. Cherepanov, A.. (2017, July 4). Analysis of TeleBots’ cunning backdoor . Retrieved June 11, 2020.
  15. Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.
  16. Dragos. (2017, January 1). ELECTRUM Threat Profile. Retrieved June 10, 2020.
  17. NCSC. (2020, February 20). NCSC supports US advisory regarding GRU intrusion set Sandworm. Retrieved June 10, 2020.
  18. National Security Agency. (2020, March 28). Sandworm Actors Exploiting Vulnerability In EXIM Mail Transfer Agent. Retrieved March 1, 2024.
  19. MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.
  20. Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020.
  21. Joseph Slowik, DomainTools. (2021, March 3). Centreon to Exim and Back: On the Trail of Sandworm. Retrieved April 6, 2024.
  22. Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.
  23. Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
  24. NCSC. (2022, February 23). Cyclops Blink Malware Analysis Report. Retrieved March 3, 2022.
  25. Billy Leonard. (2023, April 19). Ukraine remains Russia’s biggest cyber focus in 2023. Retrieved March 1, 2024.
  26. Muncaster, P.. (2014, October 14). Microsoft Zero Day Traced to Russian ‘Sandworm’ Hackers. Retrieved October 6, 2017.
  27. Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.
  28. Li, H. (2013, November 5). McAfee Labs Detects Zero-Day Exploit Targeting Microsoft Office. Retrieved June 18, 2020.
  29. Morgan, K. (2023, October 18). Government-backed actors exploiting WinRAR vulnerability. Retrieved July 19, 2024.
  30. Cherepanov, A.. (2017, June 30). TeleBots are back: Supply chain attacks against Ukraine. Retrieved June 11, 2020.
  31. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.