threat actor

Sandworm Team

activeentity:threat_actor

[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 20

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: sandworm-team
kind: threat actor
status: active
aliases: APT44 · BlackEnergy (Group) · ELECTRUM · FROZENBARENTS · IRIDIUM · IRON VIKING · Quedagh · Seashell Blizzard · Telebots · Voodoo Bear
jurisdictions: —
claims naming it: 0 · 0 attributions · 19 relations · 0 events

Identifiers

attack G0034via mitre-attack

Relations

MITRE ATT&CK Enterpriserecords thatSandworm TeamusesBad Rabbit
fetch —sha256 dc1639caa5501d72
rel_168btcintel:relations:168@v1 sha256:cc0dbcd95438b2d4
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesExaramel for Linux
fetch —sha256 dc1639caa5501d72
rel_169btcintel:relations:169@v1 sha256:0fb9468a0f09119e
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesExaramel for Windows
fetch —sha256 dc1639caa5501d72
rel_170btcintel:relations:170@v1 sha256:ca3eaeffeeca7346
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesGreyEnergy
fetch —sha256 dc1639caa5501d72
rel_171btcintel:relations:171@v1 sha256:732105c97eedd840
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesPrestige
fetch —sha256 dc1639caa5501d72
rel_172btcintel:relations:172@v1 sha256:817be597c2d5000e
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesP.A.S. Webshell
fetch —sha256 dc1639caa5501d72
rel_173btcintel:relations:173@v1 sha256:90308f65a3bb9bd3
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesAcidPour
fetch —sha256 dc1639caa5501d72
rel_174btcintel:relations:174@v1 sha256:ec9caf359eff0a7a
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesVPNFilter
fetch —sha256 dc1639caa5501d72
rel_175btcintel:relations:175@v1 sha256:a28616e9fd109041
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesNeo-reGeorg
fetch —sha256 dc1639caa5501d72
rel_176btcintel:relations:176@v1 sha256:376de6f521868da6
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesCyclops Blink
fetch —sha256 dc1639caa5501d72
rel_177btcintel:relations:177@v1 sha256:8d9515aacd8515b2
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesKapeka
fetch —sha256 dc1639caa5501d72
rel_178btcintel:relations:178@v1 sha256:0827b3a0ddd4e726
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesAcidRain
fetch —sha256 dc1639caa5501d72
rel_179btcintel:relations:179@v1 sha256:692ac058f8ed0950
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesIndustroyer
fetch —sha256 dc1639caa5501d72
rel_180btcintel:relations:180@v1 sha256:f3f3b97530b762a0
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesIndustroyer2
fetch —sha256 dc1639caa5501d72
rel_181btcintel:relations:181@v1 sha256:2a3710e9f0ece4ff
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesBlackEnergy
fetch —sha256 dc1639caa5501d72
rel_182btcintel:relations:182@v1 sha256:6ddda74c07074ddc
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_183btcintel:relations:183@v1 sha256:ac4a09e1998ac0c0
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesNotPetya
fetch —sha256 dc1639caa5501d72
rel_184btcintel:relations:184@v1 sha256:db5fef477e708cfe
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesKillDisk
fetch —sha256 dc1639caa5501d72
rel_185btcintel:relations:185@v1 sha256:ea748e21921900d3
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatSandworm TeamusesOlympic Destroyer
fetch —sha256 dc1639caa5501d72
rel_186btcintel:relations:186@v1 sha256:6595f2d66ba3fc31
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.