group
Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.[1][2] This group has been active since at least 2009.[3][4][5][6]
In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.[7][8] Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.[9]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Sandworm Team has used its plainpwd tool, a modified version of Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.101112
During the 2016 Ukraine Electric Power Attack, Sandworm Team used Mimikatz to capture and use legitimate credentials.13
Sandworm Team has used ntdsutil.exe to back up the Active Directory database, likely for credential access.14
Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.15
Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.1617
During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets. 18
During the 2016 Ukraine Electric Power Attack, Sandworm Team checked for connectivity to resources within the network and used LDAP to query Active Directory, discovering information about computers listed in AD.19
Sandworm Team has copied payloads to the ADMIN$ share of remote systems and run net use to connect to network shares.2021
During the 2016 Ukraine Electric Power Attack, Sandworm Team utilized net use to connect to network shares.22
Sandworm Team has used Base64 encoding within malware variants.23
During the 2016 Ukraine Electric Power Attack, Sandworm Team used heavily obfuscated code with Industroyer in its Windows Notepad backdoor.24
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
97th percentile · 97% of 176 ATT&CK groups have this many Enterprise techniques or fewer.
94th percentile · 94% of 176 ATT&CK groups have this many tactics spanned or fewer.
97th percentile · 97% of 176 ATT&CK groups have this many tools and malware or fewer.
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
38th percentile · 62% of 176 ATT&CK groups have more detection rules per technique.
2072 distinct rules cover the 79 techniques recorded for this group. The 2508 technique-to-rule mappings resolve to 2072 distinct rules, because one rule can cover several techniques. 1371 Sigma · 701 Splunk.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org
24th percentile · 76% of 176 ATT&CK groups have more atomic tests per technique.
65% of the population shares a single value across only 12 distinct values, so a percentile here would rank the tie, not the entity.
43% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this group’s 79 Enterprise techniques.
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other.