auren-research/cyber-sec huggingface dataset:
type: intrusion-set
spec_version: 2.1
id: intrusion-set--dc5e2999-ca1a-47d4-8d12-a6984b138a1b
created: 2021-01-05T15:34:11.066Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0118
external_id: G0118
source_name: UNC2452
description: (Citation: FireEye SUNBURST Backdoor December 2020)
source_name: NOBELIUM
description: (Citation: MSTIC NOBELIUM Mar 2021)
source_name: StellarParticle
description: (Citation: CrowdStrike SUNSPOT Implant January 2021)
source_name: Dark Halo
description: (Citation: Volexity SolarWinds)
source_name: FireEye SUNBURST Backdoor December 2020
description: FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
url: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
source_name: Volexity SolarWinds
description: Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.
url: https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
source_name: MSTIC NOBELIUM Mar 2021
description: Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.
url: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
source_name: CrowdStrike SUNSPOT Implant January 2021
description: CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.
url: https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:48:50.206Z
name: UNC2452
description: [UNC2452](https://attack.mitre.org/groups/G0118) is a suspected Russian state-sponsored threat group responsible for the 2020 SolarWinds software supply chain intrusion.(Citation: FireEye SUNBURST Backdoor December 2020) Victims of this campaign include government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East.(Citation: FireEye SUNBURST Backdoor December 2020) The group also compromised at least one think tank by late 2019.(Citation: Volexity SolarWinds)
aliases: UNC2452
NOBELIUM
StellarParticle
Dark Halo
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Katie Nickels, Red Canary
Matt Brenton, Zurich Insurance Group
modified: 2024-09-17T16:07:34.686Z
name: TA577
description: [TA577](https://attack.mitre.org/groups/G1037) is an initial access broker (IAB) that has distributed [QakBot](https://attack.mitre.org/software/S0650) and [Pikabot](https://attack.mitre.org/software/S1145), and was among the first observed groups distributing [Latrodectus](https://attack.mitre.org/software/S1160) in 2023.(Citation: Latrodectus APR 2024)
aliases: TA577
x_mitre_deprecated: no
x_mitre_version: 1.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--13ef3485-70d2-4567-b934-0e83c1eafcf1
created: 2024-09-17T16:05:53.084Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1037
external_id: G1037
source_name: Latrodectus APR 2024
description: Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.
url: https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--5cbe0d3b-6fb1-471f-b591-4b192915116d
created: 2017-05-31T21:32:06.777Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0039
external_id: G0039
source_name: Suckfly
description: (Citation: Symantec Suckfly March 2016) (Citation: Symantec Suckfly May 2016)
source_name: Symantec Suckfly March 2016
description: DiMaggio, J. (2016, March 15). Suckfly: Revealing the secret life of your code signing certificates. Retrieved August 3, 2016.
url: http://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates
source_name: Symantec Suckfly May 2016
description: DiMaggio, J. (2016, May 17). Indian organizations targeted in Suckfly attacks. Retrieved August 3, 2016.
url: http://www.symantec.com/connect/blogs/indian-organizations-targeted-suckfly-attacks
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:33.565Z
name: Suckfly
description: [Suckfly](https://attack.mitre.org/groups/G0039) is a China-based threat group that has been active since at least 2014. (Citation: Symantec Suckfly March 2016)
aliases: Suckfly
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
type: campaign
spec_version: 2.1
id: campaign--f9cc545e-b0ef-4b92-8884-a3a4427609f6
created: 2022-09-15T17:25:38.020Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0004
external_id: C0004
source_name: BlackBerry CostaRicto November 2020
description: The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.
url: https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:46.418Z
name: CostaRicto
description: [CostaRicto](https://attack.mitre.org/campaigns/C0004) was a suspected hacker-for-hire cyber espionage campaign that targeted multiple industries worldwide, with a large number being financial institutions. [CostaRicto](https://attack.mitre.org/campaigns/C0004) actors targeted organizations in Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia (especially India, Bangladesh, and Singapore), using custom malware, open source tools, and a complex network of proxies and SSH tunnels.(Citation: BlackBerry CostaRicto November 2020)
aliases: CostaRicto
first_seen: 2019-10-01T04:00:00.000Z
last_seen: 2020-11-01T04:00:00.000Z
x_mitre_first_seen_citation: (Citation: BlackBerry CostaRicto November 2020)
x_mitre_last_seen_citation: (Citation: BlackBerry CostaRicto November 2020)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_domains: enterprise-attack
modified: 2024-11-17T18:19:52.955Z
name: Silence
description: [Silence](https://attack.mitre.org/groups/G0091) is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017) 
aliases: Silence
Whisper Spider
x_mitre_deprecated: no
x_mitre_version: 2.2
x_mitre_contributors: Oleg Skulkin, Group-IB
type: intrusion-set
spec_version: 2.1
id: intrusion-set--d13c8a7f-740b-4efa-a232-de7d6bb05321
created: 2019-05-24T17:57:36.491Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0091
external_id: G0091
source_name: Whisper Spider
description: (Citation: Crowdstrike GTR2020 Mar 2020)
source_name: Silence
description: (Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017) 
source_name: Crowdstrike GTR2020 Mar 2020
description: Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.
url: https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
source_name: SecureList Silence Nov 2017
description: GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.
url: https://securelist.com/the-silence/83009/
source_name: Cyber Forensicator Silence Jan 2019
description: Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.
url: https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--64d5f96a-f121-4d19-89f6-6709f5c49faa
created: 2022-07-14T14:32:47.582Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1007
external_id: G1007
source_name: SentinelOne Aoqin Dragon June 2022
description: Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.
url: https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:33.761Z
name: Aoqin Dragon
description: [Aoqin Dragon](https://attack.mitre.org/groups/G1007) is a suspected Chinese cyber espionage threat group that has been active since at least 2013. [Aoqin Dragon](https://attack.mitre.org/groups/G1007) has primarily targeted government, education, and telecommunication organizations in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. Security researchers noted a potential association between [Aoqin Dragon](https://attack.mitre.org/groups/G1007) and UNC94, based on malware, infrastructure, and targets.(Citation: SentinelOne Aoqin Dragon June 2022)
aliases: Aoqin Dragon
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Hiroki Nagahama, NEC Corporation
Pooja Natarajan, NEC Corporation India
Manikantan Srinivasan, NEC Corporation India
modified: 2024-08-14T15:24:19.141Z
name: HEXANE
description: [HEXANE](https://attack.mitre.org/groups/G1001) is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. [HEXANE](https://attack.mitre.org/groups/G1001)'s TTPs appear similar to [APT33](https://attack.mitre.org/groups/G0064) and [OilRig](https://attack.mitre.org/groups/G0049) but due to differences in victims and tools it is tracked as a separate entity.(Citation: Dragos Hexane)(Citation: Kaspersky Lyceum October 2021)(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)
aliases: HEXANE
Lyceum
Siamesekitten
Spirlin
x_mitre_deprecated: no
x_mitre_version: 2.3
x_mitre_contributors: Dragos Threat Intelligence
Mindaugas Gudzis, BT Security
type: intrusion-set
spec_version: 2.1
id: intrusion-set--f29b7c5e-2439-42ad-a86f-9f8984fafae3
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1001
external_id: G1001
source_name: Spirlin
description: (Citation: Accenture Lyceum Targets November 2021)
source_name: Siamesekitten
description: (Citation: ClearSky Siamesekitten August 2021)
source_name: Lyceum
description: (Citation: SecureWorks August 2019)
source_name: Accenture Lyceum Targets November 2021
description: Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.
url: https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns
source_name: ClearSky Siamesekitten August 2021
description: ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.
url: https://www.clearskysec.com/siamesekitten/
source_name: Dragos Hexane
description: Dragos. (n.d.). Hexane. Retrieved October 27, 2019.
url: https://dragos.com/resource/hexane/
source_name: Kaspersky Lyceum October 2021
description: Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.
url: https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf
source_name: SecureWorks August 2019
description: SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19 
url: https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
ics-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--ebb73863-fa44-4617-b4cb-b9ed3414eb87
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0072
external_id: G0072
source_name: Honeybee
description: (Citation: McAfee Honeybee)
source_name: McAfee Honeybee
description: Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T17:59:26.884Z
name: Honeybee
description: [Honeybee](https://attack.mitre.org/groups/G0072) is a campaign led by an unknown actor that targets humanitarian aid organizations and has been active in Vietnam, Singapore, Argentina, Japan, Indonesia, and Canada. It has been an active operation since August of 2017 and as recently as February 2018. (Citation: McAfee Honeybee)
aliases: Honeybee
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--32bca8ff-d900-4877-aa65-d70baa041b74
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0077
external_id: G0077
source_name: Raspite
description: (Citation: Dragos Raspite Aug 2018)
source_name: Leafminer
description: (Citation: Symantec Leafminer July 2018)
source_name: Dragos Raspite Aug 2018
description: Dragos, Inc. (2018, August 2). RASPITE. Retrieved November 26, 2018.
url: https://www.dragos.com/blog/20180802Raspite.html
source_name: Symantec Leafminer July 2018
description: Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
url: https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:33.912Z
name: Leafminer
description: [Leafminer](https://attack.mitre.org/groups/G0077) is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. (Citation: Symantec Leafminer July 2018)
aliases: Leafminer
Raspite
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.4
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--129f2f77-1ab2-4c35-bd5e-21260cee92af
created: 2022-08-18T15:25:59.689Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1011
external_id: G1011
source_name: Google EXOTIC LILY March 2022
description: Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.
url: https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:34.060Z
name: EXOTIC LILY
description: [EXOTIC LILY](https://attack.mitre.org/groups/G1011) is a financially motivated group that has been closely linked with [Wizard Spider](https://attack.mitre.org/groups/G0102) and the deployment of ransomware including [Conti](https://attack.mitre.org/software/S0575) and [Diavol](https://attack.mitre.org/software/S0659). [EXOTIC LILY](https://attack.mitre.org/groups/G1011) may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.(Citation: Google EXOTIC LILY March 2022)
aliases: EXOTIC LILY
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Phill Taylor, BT Security
modified: 2024-04-11T00:30:09.195Z
name: Operation Honeybee
description: [Operation Honeybee](https://attack.mitre.org/campaigns/C0006) was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. [Operation Honeybee](https://attack.mitre.org/campaigns/C0006) initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign "Honeybee" after the author name discovered in malicious Word documents.(Citation: McAfee Honeybee) 
aliases: Operation Honeybee
first_seen: 2017-08-01T05:00:00.000Z
last_seen: 2018-02-01T06:00:00.000Z
x_mitre_first_seen_citation: (Citation: McAfee Honeybee)
x_mitre_last_seen_citation: (Citation: McAfee Honeybee)
x_mitre_deprecated: no
x_mitre_version: 1.1
type: campaign
spec_version: 2.1
id: campaign--4553292d-12c6-4a93-934d-12160370d4e0
created: 2022-09-16T21:08:54.358Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0006
external_id: C0006
source_name: McAfee Honeybee
description: Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
type: campaign
spec_version: 2.1
id: campaign--aa73efef-1418-4dbe-b43c-87a498e97234
created: 2023-03-31T17:22:23.567Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0025
external_id: C0025
source_name: ESET Industroyer
description: Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.
url: https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf
source_name: Dragos Crashoverride 2018
description: Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.
url: https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:46.567Z
name: 2016 Ukraine Electric Power Attack
description: [2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign during which they used [Industroyer](https://attack.mitre.org/software/S0604) malware to target and disrupt distribution substations within the Ukrainian power grid. This campaign was the second major public attack conducted against Ukraine by [Sandworm Team](https://attack.mitre.org/groups/G0034).(Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)
aliases: 2016 Ukraine Electric Power Attack
first_seen: 2016-12-01T05:00:00.000Z
last_seen: 2016-12-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)
x_mitre_last_seen_citation: (Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_domains: enterprise-attack
ics-attack