Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Sandworm · Nation-state · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

Sandworm

  • Quedagh
  • VOODOO BEAR
  • TEMP.Noble
  • IRON VIKING
  • G0034
  • ELECTRUM
  • TeleBots
  • IRIDIUM

state sponsor · Russian FederationMITRE G0034 ↗

Sandworm — ATT&CK roseSA

attack rose · 79 techniques across 13 tactics

What changed

ledger · newest first
  1. —todaynew CVE3 new CVEs: CVE-2013-3906, CVE-2014-4114, CVE-2023-38831

Analyst brief

misp-galaxy + mitre-attack

This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes. Some believe that the threat actor is linked to the 2015 compromise of the Ukrainian electrical grid and a distributed denial of service prior to the Russian invasion of Georgia. Believed to be responsible for the 2008 DDoS attacks in Georgia and the 2015 Ukraine power grid outage

Observed targets (as stated by the sources)

11 countries · 5 sectors
RussiaLithuaniaKyrgyzstanIsraelUkraineBelarusKazakhstanGeorgiaPolandAzerbaijanIranAssessed origin: Russia

assessed origin · Russiaobserved targets · 11

countries · 11

  • Russia
  • Lithuania
  • Kyrgyzstan
  • Israel
  • Ukraine
  • Belarus
  • Kazakhstan
  • Georgia
  • Poland
  • Azerbaijan
  • Iran

sectors · 5

  • Private sector
  • Government
  • Electric
  • Energy
  • Industrial

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

79 techniques · 13 of 15 tactics

  1. Reconnaissance

    9 techniques

  2. Resource development

    12 techniques

  3. Initial access

    6 techniques

  4. Execution

    9 techniques

  5. Persistence

    2 techniques

  6. Stealth

    9 techniques

  7. Credential access

    5 techniques

  8. Discovery

    7 techniques

  9. Lateral movement

    2 techniques

  10. Collection

    3 techniques

  11. Command and control

    7 techniques

  12. Exfiltration

    1 technique

  13. Impact

    7 techniques

select a technique

Arsenal

19 malware · 8 tools
Malware
Malware · 19ATT&CK
Bad RabbitS0606 ↗
Exaramel for LinuxS0401 ↗
Exaramel for WindowsS0343 ↗
GreyEnergyS0342 ↗
PrestigeS1058 ↗
P.A.S. WebshellS0598 ↗
AcidPourS1167 ↗
VPNFilterS1010 ↗
Neo-reGeorgS1189 ↗
Cyclops BlinkS0687 ↗
KapekaS1190 ↗
AcidRainS1125 ↗
IndustroyerS0604 ↗
Industroyer2S1072 ↗
BlackEnergyS0089 ↗
Cobalt StrikeS0154 ↗
NotPetyaS0368 ↗
KillDiskS0607 ↗
Olympic DestroyerS0365 ↗
Tools
Tools · 8ATT&CK
MimikatzS0002 ↗
PsExecS0029 ↗
SDeleteS0195 ↗
EmpireS0363 ↗
NetS0039 ↗
PoshC2S0378 ↗
ImpacketS0357 ↗
Invoke-PSImageS0231 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs cited sources tie to Sandworm

none on KEV
  1. CVE-2014-41142026-10-17
    1. “The PowerPoint files appear to exploit the Microsoft Windows OLE Package Manager Remote Code Execution Vulnerability (CVE-2014-4114), which was used in the Sandworm attack s against American and European targets in October 2014.”

      cited as used in a campaign · source: community.broadcom.com ↗ · 2026-10-17

    2. “Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2013-39062026-10-17
    1. “Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2023-388312026-10-17
    1. “which delivered a benign decoy PDF document with a drone operator training curriculum and a malicious ZIP file exploiting CVE-2023-38831 titled “Навчальна-програма-Оператори.zip” (Training program operators).”

      cited as exploiting · named nearby · source: blog.google ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2022New Sandworm Malware Cyclops Blink Replaces VPNFilterCISA ↗
  2. 2022Cyberattack by Sandworm Group (UAC-0082) on energy facilities of Ukraine using malicious programs INDUSTROYER2 and CADDYWIPERCERT-UA ↗
  3. 2017TeleBots are back: supply-chain attacks against UkraineESET ↗
  4. 2014Blackenergy & Quedagh: The Convergence Of Crimeware And Apt AttacksF-Secure ↗
  5. 2014Russian Cyber Espionage Campaign - Sandworm TeamiSight Partners ↗

Take it with you

keyless · no signup

References

32 sources
  1. 1.dragos.com/blog/crashoverride/CrashOverride-01.pdf
  2. 2.us-cert.gov/ncas/alerts/TA17-163A
  3. 3.ics.sans.org/blog/2016/01/09/confirmation-of-a-coordinated-attack-o…
  4. 4.web.archive.org/web/20141016132823/https://www.symantec.com/connect/bl…
  5. 5.ics.sans.org/blog/2015/12/30/current-reporting-on-the-cyber-attack-…
  6. 6.web.archive.org/web/20141224060545/http://blog.trendmicro.com/trendlab…
  7. 7.attack.mitre.org/groups/G0034
  8. 8.blog.google/threat-analysis-group/continued-cyber-activity-in-east…
  9. 9.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf
  10. 10.dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf
  11. +22 more in the JSON record

Track Sandworm on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.