AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Sandworm Team
Aliases: APT44, BlackEnergy (Group), ELECTRUM, FROZENBARENTS, IRIDIUM, IRON VIKING, Quedagh, Sandworm Team, Seashell Blizzard, Telebots, Voodoo Bear
[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020) In October 2020, the US indicted six GRU Unit 74455 officers associated with [Sandworm Team](https://attack.mitre.org/groups/G0034) for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide [NotPetya](https://attack.mitre.org/software/S0368) attack, targeting of the 2017 French presidential campaign, the 2018 [Olympic Destroyer](https://attack.mitre.org/software/S0365) attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as [APT28](https://attack.mitre.org/groups/G0007).(Citation: US District Court Indictment GRU Oct 2018)
Open interactive actor investigation
ATT&CK techniques
T1003.001T1003.003T1005T1018T1021.002T1027T1027.010T1033T1036T1036.005T1040T1041T1047T1049T1053.005T1056.001T1059.001T1059.005T1070.004T1071.001T1072T1078T1078.002T1082T1083T1087.002T1087.003T1090T1102.002T1105T1106T1132.001T1133T1140T1190T1195T1195.002T1199T1203T1204.001T1204.002T1213.006T1218.011T1219T1485T1486T1489T1490T1491.002T1499T1505.003T1539T1555.003T1561.002T1566.001T1566.002T1570T1571T1583T1583.001T1583.004T1584.004T1584.005T1585.001T1585.002T1586.001T1587.001T1588.002T1588.006T1589.002T1589.003T1590.001T1591.002T1592.002T1593T1594T1595.002T1598.003T1608.001
Correlated CTI and IR reports
ATT&CK as a Working Tool: Theory and Hands-On Practical Usage
1200km CTI repository · explicit report mentionBlue-Team IOC Tables — Consolidated
1200km CTI repository · explicit report mentionCTI
1200km CTI repository · explicit report mentionCTI Research Template
1200km CTI repository · explicit report mentionCTI Research: Sandworm / APT44
1200km CTI repository · explicit report mentionCTI Research: Sandworm / APT44
1200km CTI repository · explicit report mentionCTI Research: Sandworm / APT44
1200km CTI repository · explicit report mentionGitHub repo: description and short description
1200km CTI repository · explicit report mentionIOC Tables — Sandworm / APT44 (Seashell Blizzard)
1200km CTI repository · explicit report mentionCTI Research Sandworm APT44
1200km Medium · authored report mention
1200km CTI repository · explicit report mentionBlue-Team IOC Tables — Consolidated
1200km CTI repository · explicit report mentionCTI
1200km CTI repository · explicit report mentionCTI Research Template
1200km CTI repository · explicit report mentionCTI Research: Sandworm / APT44
1200km CTI repository · explicit report mentionCTI Research: Sandworm / APT44
1200km CTI repository · explicit report mentionCTI Research: Sandworm / APT44
1200km CTI repository · explicit report mentionGitHub repo: description and short description
1200km CTI repository · explicit report mentionIOC Tables — Sandworm / APT44 (Seashell Blizzard)
1200km CTI repository · explicit report mentionCTI Research Sandworm APT44
1200km Medium · authored report mention
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PsExec tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Cobalt Strike tool reference — Explicit actor uses software relationship in pinned ATT&CK
- SDelete tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Invoke-PSImage tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Impacket tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Empire tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PoshC2 tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003.001 LSASS Memory simulation — Exact active technique ID
- T1003.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.003 NTDS simulation — Exact active technique ID
- T1003.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1005 Data from Local System simulation — Exact active technique ID
- T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1018 Remote System Discovery simulation — Exact active technique ID
- T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.002 SMB/Windows Admin Shares simulation — Exact active technique ID
- T1021.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027 Obfuscated Files or Information simulation — Exact active technique ID
- T1027 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.010 Command Obfuscation simulation — Exact active technique ID
- T1027.010 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1033 System Owner/User Discovery simulation — Exact active technique ID
- T1033 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036 Masquerading simulation — Exact active technique ID
- T1036 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1040 Network Sniffing simulation — Exact active technique ID
- T1040 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1041 Exfiltration Over C2 Channel simulation — Exact active technique ID
- T1041 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1049 System Network Connections Discovery simulation — Exact active technique ID
- T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.005 Scheduled Task simulation — Exact active technique ID
- T1053.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1056.001 Keylogging simulation — Exact active technique ID
- T1056.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.005 Visual Basic simulation — Exact active technique ID
- T1059.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1072 Software Deployment Tools simulation — Exact active technique ID
- T1072 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.002 Domain Accounts simulation — Exact active technique ID
- T1078.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.002 Domain Account simulation — Exact active technique ID
- T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.003 Email Account simulation — Exact active technique ID
- T1087.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090 Proxy simulation — Exact active technique ID
- T1090 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1102.002 Bidirectional Communication simulation — Exact active technique ID
- T1102.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1106 Native API simulation — Exact active technique ID
- T1106 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1132.001 Standard Encoding simulation — Exact active technique ID
- T1132.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1195 Supply Chain Compromise simulation — Exact active technique ID
- T1195 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1195.002 Compromise Software Supply Chain simulation — Exact active technique ID
- T1195.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1199 Trusted Relationship simulation — Exact active technique ID
- T1199 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1203 Exploitation for Client Execution simulation — Exact active technique ID
- T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.001 Malicious Link simulation — Exact active technique ID
- T1204.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.006 Databases simulation — Exact active technique ID
- T1213.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.011 Rundll32 simulation — Exact active technique ID
- T1218.011 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1219 Remote Access Tools simulation — Exact active technique ID
- T1219 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1485 Data Destruction simulation — Exact active technique ID
- T1485 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1486 Data Encrypted for Impact simulation — Exact active technique ID
- T1486 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1489 Service Stop simulation — Exact active technique ID
- T1489 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1490 Inhibit System Recovery simulation — Exact active technique ID
- T1490 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1491.002 External Defacement simulation — Exact active technique ID
- T1491.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1499 Endpoint Denial of Service simulation — Exact active technique ID
- T1499 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1505.003 Web Shell simulation — Exact active technique ID
- T1505.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1539 Steal Web Session Cookie simulation — Exact active technique ID
- T1539 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.003 Credentials from Web Browsers simulation — Exact active technique ID
- T1555.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1561.002 Disk Structure Wipe simulation — Exact active technique ID
- T1561.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.002 Spearphishing Link simulation — Exact active technique ID
- T1566.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1570 Lateral Tool Transfer simulation — Exact active technique ID
- T1570 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1571 Non-Standard Port simulation — Exact active technique ID
- T1571 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583 Acquire Infrastructure simulation — Exact active technique ID
- T1583 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.001 Domains simulation — Exact active technique ID
- T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.004 Server simulation — Exact active technique ID
- T1583.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.004 Server simulation — Exact active technique ID
- T1584.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.005 Botnet simulation — Exact active technique ID
- T1584.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1585.001 Social Media Accounts simulation — Exact active technique ID
- T1585.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1585.002 Email Accounts simulation — Exact active technique ID
- T1585.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1586.001 Social Media Accounts simulation — Exact active technique ID
- T1586.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.001 Malware simulation — Exact active technique ID
- T1587.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.006 Vulnerabilities simulation — Exact active technique ID
- T1588.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1589.002 Email Addresses simulation — Exact active technique ID
- T1589.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1589.003 Employee Names simulation — Exact active technique ID
- T1589.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1590.001 Domain Properties simulation — Exact active technique ID
- T1590.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1591.002 Business Relationships simulation — Exact active technique ID
- T1591.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1592.002 Software simulation — Exact active technique ID
- T1592.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1593 Search Open Websites/Domains simulation — Exact active technique ID
- T1593 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1594 Search Victim-Owned Websites simulation — Exact active technique ID
- T1594 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1595.002 Vulnerability Scanning simulation — Exact active technique ID
- T1595.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1598.003 Spearphishing Link simulation — Exact active technique ID
- T1598.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1608.001 Upload Malware simulation — Exact active technique ID
- T1608.001 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idDependencies, source control, builds, artifacts, and supply-chain assurance
Secure Code & Application Security · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameReadiness, mandate, governance, and communications
Digital Forensics & Incident Response (DFIR) · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idDependencies, source control, builds, artifacts, and supply-chain assurance
Secure Code & Application Security · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameReadiness, mandate, governance, and communications
Digital Forensics & Incident Response (DFIR) · explicit-name
Related sector research
Editorial reading routes, not additional MITRE relationships or proof of an actor's involvement in a particular incident.
- Cyberattacks on Big Pharma and Its Ecosystem — Government attribution of NotPetya; Merck suffered collateral impact. Evidence cutoff: 2026-09-25.