Sandworm
QuedaghVOODOO BEARTEMP.NobleIRON VIKINGG0034ELECTRUMTeleBotsIRIDIUMBlue EchidnaFROZENBARENTSUAC-0113Seashell BlizzardUAC-0082APT44SANDWORM RELICUAC-0145
This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes. Some believe that the threat actor is linked to the 2015 compromise of the Ukrainian electrical grid and a distributed denial of service prior to the Russian invasion of Georgia. Believed to be… Source: MISP
Attributed country: RU according to MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 14 Sep 2026 · last seen on 14 Sep 2026
News
- 'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops BlinkDark Reading · 14 Sep 2026
Appears alongside
MITRE ATT&CK techniques
Reconnaissance
T1589.002Email Addresses 1 Sigma rulesT1589.003Employee NamesT1590.001Domain Properties 1 Sigma rulesT1591.002Business RelationshipsT1592.002SoftwareT1593Search Open Websites/Domains 2 Sigma rulesT1594Search Victim-Owned WebsitesT1595.002Vulnerability Scanning 1 Sigma rulesT1598.003Spearphishing Link
Resource Development
T1583Acquire InfrastructureT1583.001DomainsT1583.004ServerT1584.004ServerT1584.005BotnetT1585.001Social Media AccountsT1585.002Email AccountsT1586.001Social Media AccountsT1587.001Malware 10 Sigma rulesT1588.002Tool 7 Sigma rulesT1588.006VulnerabilitiesT1608.001Upload Malware
Initial Access
T1078Valid Accounts 82 Sigma rulesT1078.002Domain Accounts 3 Sigma rulesT1133External Remote Services 17 Sigma rulesT1190Exploit Public-Facing Application 40 Sigma rulesT1195Supply Chain Compromise 19 Sigma rulesT1195.002Compromise Software Supply Chain 17 Sigma rulesT1199Trusted Relationship 1 Sigma rulesT1566.001Spearphishing Attachment 21 Sigma rulesT1566.002Spearphishing Link 3 Sigma rules
Execution
T1047Windows Management Instrumentation 40 Sigma rulesT1053.005Scheduled Task 40 Sigma rulesT1059.001PowerShell 40 Sigma rulesT1059.005Visual Basic 28 Sigma rulesT1072Software Deployment Tools 4 Sigma rulesT1106Native API 12 Sigma rulesT1203Exploitation for Client Execution 31 Sigma rulesT1204.001Malicious Link 4 Sigma rulesT1204.002Malicious File 32 Sigma rules
Persistence
Credential Access
T1003.001LSASS Memory 40 Sigma rulesT1003.003NTDS 23 Sigma rulesT1040Network Sniffing 7 Sigma rulesT1056.001Keylogging 3 Sigma rulesT1539Steal Web Session Cookie 2 Sigma rulesT1555.003Credentials from Web Browsers 6 Sigma rules
Discovery
T1018Remote System Discovery 9 Sigma rulesT1033System Owner/User Discovery 26 Sigma rulesT1049System Network Connections Discovery 2 Sigma rulesT1082System Information Discovery 18 Sigma rulesT1083File and Directory Discovery 17 Sigma rulesT1087.002Domain Account 19 Sigma rulesT1087.003Email Account
Lateral Movement
Collection
Command and Control
T1071.001Web Protocols 39 Sigma rulesT1090Proxy 31 Sigma rulesT1102.002Bidirectional Communication 3 Sigma rulesT1105Ingress Tool Transfer 40 Sigma rulesT1132.001Standard Encoding 4 Sigma rulesT1219Remote Access Tools 46 Sigma rulesT1571Non-Standard Port 5 Sigma rules
Exfiltration
Impact
T1485Data Destruction 15 Sigma rulesT1486Data Encrypted for Impact 14 Sigma rulesT1489Service Stop 13 Sigma rulesT1490Inhibit System Recovery 26 Sigma rulesT1491.002External DefacementT1499Endpoint Denial of Service 7 Sigma rulesT1561.002Disk Structure Wipe 1 Sigma rules
Stealth
T1027Obfuscated Files or Information 61 Sigma rulesT1027.010Command Obfuscation 8 Sigma rulesT1036Masquerading 88 Sigma rulesT1036.005Match Legitimate Resource Name or Location 20 Sigma rulesT1070.004File Deletion 9 Sigma rulesT1140Deobfuscate/Decode Files or Information 17 Sigma rulesT1218.011Rundll32 40 Sigma rules
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗