During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Systemd service units to masquerade GOGETTER malware as legitimate or seemingly legitimate services.3
campaign
2022 Ukraine Electric Power Attack C0034
- First seen
- June 2022
- Last seen
- October 2022
- Created
- 27 March 2024
- Last modified
- 31 July 2026
The 2022 Ukraine Electric Power Attack was a Sandworm Team campaign that used a combination of GOGETTER, Neo-REGEORG, CaddyWiper, and living of the land (LotL) techniques to gain access to a Ukrainian electric utility to send unauthorized commands from their SCADA system.[1][2]
10
Techniques32nd pct
8
Tactics48th pct
1
Tool or malware45th pct
1
Threat groupunranked
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference C0034
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.4
During the 2022 Ukraine Electric Power Attack, Sandworm Team utilized a PowerShell utility called TANKTRAP to spread and launch a wiper using Windows Group Policy.5
During the 2022 Ukraine Electric Power Attack, Sandworm Team proxied C2 communications within a TLS-based tunnel.6
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Group Policy Objects (GPOs) to deploy and execute malware.7
During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed CaddyWiper on the victim’s IT environment systems to wipe files related to the OT capabilities, along with mapped drives, and physical drive partitions.8
Standing C0034
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques1032nd pct
32nd percentile · 68% of 56 ATT&CK campaigns have more Enterprise techniques.
Tactics848th pct
48th percentile · 52% of 56 ATT&CK campaigns have more tactics spanned.
Tool or malware145th pct
45th percentile · 55% of 56 ATT&CK campaigns have more tools and malware.
Threat group155% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique24.5medTop 23%
77th percentile · 77% of 56 ATT&CK campaigns have this many detection rules per technique or fewer.
Tests / technique4med
Detection coverage C0034
536 distinct rules cover the 10 techniques recorded for this campaign. The 556 technique-to-rule mappings resolve to 536 distinct rules, because one rule can cover several techniques. 371 Sigma · 165 Splunk.
10 covered by at least one rule536 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org