Cyb3rWard0g/ATTCKGroups huggingface dataset:
Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.001|Dead Drop Resolver|

Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Rocke has deleted files on infected machines.(Citation: Anomali Rocke March 2019)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Rocke can detect a running process's PID on the infected machine.(Citation: Anomali Rocke March 2019)  |
|mitre-attack|enterprise-attack|macOS,Linux|T1222.002|Linux and Mac File and Directory Permissions Modification|

Rocke has changed file permissions of files so they could not be modified.(Citation: Anomali Rocke March 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.006|Timestomp|

Rocke has changed the time stamp of certain files.(Citation: Anomali Rocke March 2019) |
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1037|Boot or Logon Initialization Scripts|

Rocke has installed an "init.d" startup script to maintain persistence.(Citation: Anomali Rocke March 2019) |
|mitre-attack|enterprise-attack|Linux|T1543.002|Systemd Service|

Rocke has installed a systemd service script to maintain persistence.(Citation: Anomali Rocke March 2019)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1571|Non-Standard Port|
Rocke's miner connects to a C2 server using port 51640.(Citation: Anomali Rocke March 2019)    |
RTM - G0048

Created: 2017-05-31T21:32:10.206Z

Modified: 2020-05-12T22:16:44.650Z

Contributors: Oleg Skulkin, Group-IB

Aliases

RTM

Description

RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name (RTM). (Citation: ESET RTM Feb 2017)

Techniques Used

RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.(Citation: Group IB RTM August 2019)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

RTM has used search order hijacking to force TeamViewer to load a malicious DLL.(Citation: Group IB RTM August 2019)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

RTM has used a modified version of TeamViewer and Remote Utilities for remote access.(Citation: Group IB RTM August 2019)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

RTM has used Registry run keys to establish persistence for the

RTM Trojan and other tools, such as a modified version of TeamViewer remote desktop software.(Citation: ESET RTM Feb 2017)(Citation: Group IB RTM August 2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

RTM has used spearphishing attachments to distribute its malware.(Citation: Group IB RTM August 2019)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

RTM has distributed its malware via the RIG and SUNDOWN exploit kits, as well as online advertising network

RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names.(Citation: ESET RTM Feb 2017)|
Sandworm Team - G0034

Created: 2017-05-31T21:32:04.588Z

Modified: 2023-03-08T22:12:31.238Z

Contributors: Dragos Threat Intelligence

Aliases

Sandworm Team,ELECTRUM,Telebots,IRON VIKING,BlackEnergy (Group),Quedagh,Voodoo Bear,IRIDIUM

Description

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020)

In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.(Citation: US District Court Indictment GRU Oct 2018)

Techniques Used

Sandworm Team has used the commercially available tool RemoteExec for agentless remote code execution.(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|
Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.(Citation: ESET Telebots Dec 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1003.003|NTDS|

Sandworm Team has used

Sandworm Team has used

Prestige ransomware to encrypt data at targeted organizations in transportation and related logistics industries in Ukraine and Poland.(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1584.005|Botnet|

Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.(Citation: NCSC Cyclops Blink February 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1047|Windows Management Instrumentation|

Sandworm Team has used

Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.(Citation: Dragos Crashoverride 2018)(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Sandworm Team has copied payloads to the

Sandworm Team has used

Prestige ransomware--to an Active Directory Domain Controller and distributed via the Default Domain Group Policy Object.(Citation: Dragos Crashoverride 2018)(Citation: Microsoft Prestige ransomware October 2022) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,macOS,Linux|T1136.002|Domain Account|

Sandworm Team has created new domain accounts on an ICS access server.(Citation: Dragos Crashoverride 2018)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Sandworm Team has used webshells including
Sandworm Team has used webshells including

P.A.S. Webshell to maintain access to victim networks.(Citation: ANSSI Sandworm January 2021)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1589.002|Email Addresses|

Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1589.003|Employee Names|

Sandworm Team's research of potential victim organizations included the identification and collection of employee information.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1598.003|Spearphishing Link|

Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1592.002|Software|

Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017

NotPetya attack.

Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1593|Search Open Websites/Domains|

Sandworm Team researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the

NotPetya attack.
Sandworm Team researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the

NotPetya attack.

Sandworm Team has also researched third-party websites to help it craft credible spearphishing emails.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Sandworm Team has collected the username from a compromised host.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Sandworm Team has enumerated files on a compromised host.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Dragos Crashoverride 2018)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1591.002|Business Relationships|In preparation for its attack against the 2018 Winter Olympics,

Sandworm Team conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1595.002|Vulnerability Scanning|
Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1588.006|Vulnerabilities|In 2017,

Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1588.002|Tool|

Sandworm Team has acquired open-source tools for their operations, including

Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to

Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as

Impacket and RemoteExec, which were used in their 2022

Prestige operations.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1059.001|PowerShell|

Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Dragos Crashoverride 2018) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Dragos Crashoverride 2018) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|
Sandworm Team has used stolen credentials to access administrative accounts within the domain.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1594|Search Victim-Owned Websites|

Sandworm Team has conducted research against potential victim websites as part of its operational planning.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,IaaS,Linux,macOS|T1491.002|External Defacement|

Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1590.001|Domain Properties|

Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1499|Endpoint Denial of Service|

Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1583.004|Server|

Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1583.001|Domains|
Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Sandworm Team has crafted phishing emails containing malicious hyperlinks.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|

Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1585.002|Email Accounts|

Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1585.001|Social Media Accounts|

Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1587.001|Malware|

Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as

NotPetya and
Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as

NotPetya and

Olympic Destroyer.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.(Citation: ESET Telebots Dec 2016)(Citation: Dragos Crashoverride 2018) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Office 365,Google Workspace|T1087.003|Email Account|

Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.(Citation: ESET Telebots July 2017)   |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Sandworm Team used a backdoor to enumerate information about the infected system's operating system.(Citation: ESET Telebots July 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)   |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1218.011|Rundll32|

Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.(Citation: ESET Telebots July 2017)    |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1195.002|Compromise Software Supply Chain|

Sandworm Team has distributed
Sandworm Team has distributed

NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.(Citation: Secureworks NotPetya June 2017)(Citation: ESET Telebots June 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

Sandworm Team has used port 6789 to accept connections on the group's SSH server.(Citation: ESET BlackEnergy Jan 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,Windows,macOS|T1219|Remote Access Software|

Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.(Citation: US-CERT Ukraine Feb 2016)(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network.

Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.(Citation: ESET BlackEnergy Jan 2016)(Citation: ESET Telebots June 2017)(Citation: ANSSI Sandworm January 2021)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Sandworm Team has created VBScripts to run an SSH server.(Citation: ESET BlackEnergy Jan 2016)(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)(Citation: Dragos Crashoverride 2018) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|
Sandworm Team have used previously acquired legitimate credentials prior to attacks.(Citation: US-CERT Ukraine Feb 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1561.002|Disk Structure Wipe|

Sandworm Team has used the

BlackEnergy KillDisk component to corrupt the infected system's master boot record.(Citation: US-CERT Ukraine Feb 2016)(Citation: ESET Telebots June 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,IaaS,Linux,macOS|T1485|Data Destruction|

Sandworm Team has used the

BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces. (Citation: US-CERT Ukraine Feb 2016)(Citation: ESET Telebots June 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Sandworm Team has avoided detection by naming a malicious binary explorer.exe.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor.
Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor.

Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.(Citation: ESET Telebots Dec 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1003.001|LSASS Memory|

Sandworm Team has used its plainpwd tool, a modified version of

Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)(Citation: Microsoft Prestige ransomware October 2022)    |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.(Citation: ESET Telebots Dec 2016)   |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network,IaaS|T1040|Network Sniffing|