G0034: Sandworm Team

Sandworm Team staged compromised versions of legitimate software installers in forums to enable initial access to executing user.[8]

In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.[1]

Sandworm Team has used intercepter-NG to sniff passwords in network traffic.CitationESET Telebots Dec 2016

Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.CitationESET Telebots Dec 2016

Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.[1]

Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.[1]

Sandworm Team creates credential capture webpages to compromise existing, legitimate social media accounts.CitationSlowik Sandworm 2021

Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.CitationESET Telebots Dec 2016

Sandworm Team exfiltrates data of interest from enterprise databases using Adminer.[10]

Sandworm Team used information stealer malware to collect browser session cookies.[10]

Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.[1]CitationDragos Crashoverride 2018

Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.CitationESET Telebots Dec 2016

Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).CitationiSight Sandworm Oct 2014CitationTrendMicro Sandworm October 2014CitationMcAfee Sandworm November 2013

Sandworm Team has sent system information to its C2 server using HTTP.CitationESET Telebots Dec 2016

Sandworm Team leveraged SHARPIVORY, a .NET dropper that writes embedded payload to disk and uses scheduled tasks to persist on victim machines.[8]

Sandworm Team exploits public-facing applications for initial access and to acquire infrastructure, such as exploitation of the EXIM mail transfer agent in Linux systems.CitationNSA Sandworm 2020[10]

Sandworm Team has used stolen credentials to access administrative accounts within the domain.[1][11]

Sandworm Team has used `ntdsutil.exe` to back up the Active Directory database, likely for credential access.[11]

Sandworm Team masqueraded malicious installers as Windows update packages to evade defense and entice users to execute binaries.[10]

Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.[1]

Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.CitationESET BlackEnergy Jan 2016CitationESET Telebots June 2017CitationANSSI Sandworm January 2021[8]

Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.[1]

Sandworm Team has used the commercially available tool RemoteExec for agentless remote code execution.[11]

Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.CitationNCSC Cyclops Blink February 2022

Sandworm Team has crafted phishing emails containing malicious hyperlinks.[1]

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.CitationESET Telebots Dec 2016CitationDragos Crashoverride 2018

Sandworm Team's research of potential victim organizations included the identification and collection of employee information.[1]

Sandworm Team have used previously acquired legitimate credentials prior to attacks.CitationUS-CERT Ukraine Feb 2016

Sandworm Team has delivered malicious Microsoft Office and ZIP file attachments via spearphishing emails.CitationiSight Sandworm Oct 2014CitationUS-CERT Ukraine Feb 2016CitationESET Telebots Dec 2016[1]CitationGoogle_WinRAR_vuln_2023[8]

Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.CitationESET Telebots Dec 2016[1]

Sandworm Team uses Prestige to disable and restore file system redirection by using the following functions: `Wow64DisableWow64FsRedirection()` and `Wow64RevertWow64FsRedirection()`.[11]

Sandworm Team has acquired open-source tools for their operations, including Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as Impacket and RemoteExec, which were used in their 2022 Prestige operations.[1][11] Additionally, Sandworm Team has used Empire, Cobalt Strike and PoshC2.[8]

Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.[1]

Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.[1]

Sandworm Team has enumerated files on a compromised host.[1]CitationDragos Crashoverride 2018

Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.[1]CitationDragos Crashoverride 2018

Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.CitationESET Telebots Dec 2016

Sandworm Team attempts to stop the MSSQL Windows service to ensure successful encryption of locked files.[11]

Sandworm Team has used port 6789 to accept connections on the group's SSH server.CitationESET BlackEnergy Jan 2016

Sandworm Team has used backdoors that can delete files used in an attack from an infected system.CitationESET Telebots Dec 2016CitationESET Telebots July 2017CitationMandiant-Sandworm-Ukraine-2022

Sandworm Team has used Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.CitationDragos Crashoverride 2018[11]

Sandworm Team has copied payloads to the `ADMIN$` share of remote systems and run net use to connect to network shares.CitationDragos Crashoverride 2018[11]

Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.[1]

Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.CitationANSSI Sandworm January 2021

Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.CitationESET Telebots July 2017

Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.[1]

Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.CitationSecureworks NotPetya June 2017CitationESET Telebots June 2017[1]

Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization.[1] Additionally, Sandworm Team has accessed Internet service providers and telecommunication entities that provide mobile connectivity.[8]

Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.CitationESET Telebots Dec 2016

Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.CitationUS-CERT Ukraine Feb 2016CitationESET Telebots June 2017

Sandworm Team has used Prestige ransomware to encrypt data at targeted organizations in transportation and related logistics industries in Ukraine and Poland.[11]

Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.[1]

Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.[1][2]

Sandworm Team used various third-party email campaign management services to deliver phishing emails.[10]

Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.CitationUS-CERT Ukraine Feb 2016[11]

Sandworm Team compromised legitimate Linux servers running the EXIM mail transfer agent for use in subsequent campaigns.CitationNSA Sandworm 2020[10]

Sandworm Team has used its plainpwd tool, a modified version of Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.CitationESET Telebots Dec 2016CitationESET Telebots June 2017[11]