Sandworm

Actor Type	Nation State
Attributed to Nation	Russia
Directly Linked Intrusion Sets	Seashell Blizzard , UAC-0002 , APT44 , FROZENBARENTS , ELECTRUM , UAC-0133
Associated Threat Actor	GRU Unit 74455

Sandworm is a cyber threat actor reportedly linked to the Russian government and responsible for conducting numerous cyber attack campaigns. The group have been identified as being responsible for disruptive and destructive attacks against multiple targets.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

Sandworm Threat Reports

Report

KAPEKA A novel backdoor spotted in Eastern Europe

This report from researchers at WithSecure unveils a novel backdoor: 'Kapeka'. Kapeka has been used against victims in Eastern Europe ...

View Source

Report

AcidPour - New Embedded Wiper Variant of AcidRain Appears in Ukraine

This blog post by researchers at SentinelLabs describes a new variant of the AcidRain malware which they call AcidPour. The report includes ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.

Search:

ATT&CK ID	Title	Associated Tactics
T1497.003	Time Based Evasion	Defense Evasion, Discovery
T1012	Query Registry	Discovery
T1001.001	Junk Data	Command and Control
T1059.003	Windows Command Shell	Execution
T1105	Ingress Tool Transfer	Command and Control
T1124	System Time Discovery	Discovery
T1090.001	Internal Proxy	Command and Control
T1112	Modify Registry	Defense Evasion
T1041	Exfiltration Over C2 Channel	Exfiltration
T1027	Obfuscated Files or Information	Defense Evasion
T1559.001	Component Object Model	Execution
T1070.009	Clear Persistence	Defense Evasion
T1547.001	Registry Run Keys / Startup Folder	Persistence, Privilege Escalation
T1614.001	System Language Discovery	Discovery
T1082	System Information Discovery	Discovery
T1070.004	File Deletion	Defense Evasion
T1027.009	Embedded Payloads	Defense Evasion
T1573.002	Asymmetric Cryptography	Command and Control
T1218.011	Rundll32	Defense Evasion
T1573.001	Symmetric Cryptography	Command and Control
T1036.008	Masquerade File Type	Defense Evasion
T1564.001	Hidden Files and Directories	Defense Evasion
T1053.005	Scheduled Task	Execution, Persistence, Privilege Escalation
T1033	System Owner/User Discovery	Discovery

Showing 1 to 24 of 24 entries

Sandworm

Cyber Threat Graph Context

Sandworm Threat Reports

KAPEKA A novel backdoor spotted in Eastern Europe

AcidPour - New Embedded Wiper Variant of AcidRain Appears in Ukraine

References

services.google.com

www.dragos.com

www.justice.gov

www.cisa.gov

labs.withsecure.com

www.mandiant.com

www.microsoft.com

www.welivesecurity.com

www.mandiant.com

services.google.com

www.sentinelone.com

cert.gov.ua

MITRE ATT&CK Techniques