RURussian Federationconfidence: 50
SandwormSandworm
Also known as: Quedagh · VOODOO BEAR · TEMP.Noble · IRON VIKING · G0034 · ELECTRUM · TeleBots · IRIDIUM · Blue Echidna · FROZENBARENTS · UAC-0113 · Seashell Blizzard · UAC-0082 · APT44 · Sandworm
Origin
RU
Known aliases
15
Target sectors
2
Attribution
State-sponsored
Profile
This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes. Some believe that the threat actor is linked to the 2015 compromise of the Ukrainian electrical grid and a distributed denial of service prior to the Russian invasion of Georgia. Believed to be responsible for the 2008 DDoS attacks in Georgia and the 2015 Ukraine power grid outage
Aliases· 15
QuedaghVOODOO BEARTEMP.NobleIRON VIKINGELECTRUMTeleBotsIRIDIUMBlue EchidnaFROZENBARENTSUAC-0113Seashell BlizzardUAC-0082APT44Sandworm
Target sectors· 2
Private sectorGovernment
Known victims· 11
- Russia
- Lithuania
- Kyrgyzstan
- Israel
- Ukraine
- Belarus
- Kazakhstan
- Georgia
- Poland
- Azerbaijan
- Iran
References
- https://dragos.com/blog/crashoverride/CrashOverride-01.pdf
- https://www.us-cert.gov/ncas/alerts/TA17-163A
- https://ics.sans.org/blog/2016/01/09/confirmation-of-a-coordinated-attack-on-the-ukrainian-power-grid
- https://web.archive.org/web/20141016132823/https://www.symantec.com/connect/blogs/sandworm-windows-zero-day-vulnerability-being-actively-exploited-targeted-attacks
- https://ics.sans.org/blog/2015/12/30/current-reporting-on-the-cyber-attack-in-ukraine-resulting-in-power-outage
- https://web.archive.org/web/20141224060545/http://blog.trendmicro.com/trendlabs-security-intelligence/timeline-of-sandworm-attacks/
- https://attack.mitre.org/groups/G0034
- https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.