Sandworm Team

IntrusionSet · ATTACK:ics:G0034

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:ics:G0034",
  "title": "Sandworm Team",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0034",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
  "external_id": "G0034",
  "domain": "ics",
  "created": "2017-05-31T21:32:04.588Z",
  "modified": "2026-07-31T20:48:32.342Z",
  "version": "4.2",
  "aliases": [
    "Sandworm Team",
    "ELECTRUM",
    "Telebots",
    "IRON VIKING",
    "BlackEnergy (Group)",
    "Quedagh",
    "Voodoo Bear",
    "IRIDIUM",
    "Seashell Blizzard",
    "FROZENBARENTS",
    "APT44"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Voodoo Bear"
    },
    {
      "source_name": "ELECTRUM"
    },
    {
      "source_name": "Sandworm Team"
    },
    {
      "source_name": "Quedagh"
    },
    {
      "source_name": "FROZENBARENTS"
    },
    {
      "source_name": "APT44"
    },
    {
      "source_name": "IRIDIUM"
    },
    {
      "source_name": "Seashell Blizzard"
    },
    {
      "source_name": "BlackEnergy (Group)"
    },
    {
      "source_name": "Telebots"
    },
    {
      "source_name": "IRON VIKING"
    },
    {
      "source_name": "Leonard TAG 2023",
      "url": "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"
    },
    {
      "source_name": "US District Court Indictment GRU Oct 2018",
      "url": "https://www.justice.gov/opa/page/file/1098481/download"
    },
    {
      "source_name": "Dragos ELECTRUM",
      "url": "https://www.dragos.com/resource/electrum/"
    },
    {
      "source_name": "F-Secure BlackEnergy 2014",
      "url": "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"
    },
    {
      "source_name": "iSIGHT Sandworm 2014",
      "url": "https://www.fireeye.com/blog/threat-research/2016/01/ukraine-and-sandworm-team.html"
    },
    {
      "source_name": "CrowdStrike VOODOO BEAR",
      "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-january-voodoo-bear/"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Microsoft Prestige ransomware October 2022",
      "url": "https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"
    },
    {
      "source_name": "InfoSecurity Sandworm Oct 2014",
      "url": "https://www.infosecurity-magazine.com/news/microsoft-zero-day-traced-russian/"
    },
    {
      "source_name": "NCSC Sandworm Feb 2020",
      "url": "https://www.ncsc.gov.uk/news/ncsc-supports-sandworm-advisory"
    },
    {
      "source_name": "USDOJ Sandworm Feb 2020",
      "url": "https://2017-2021.state.gov/the-united-states-condemns-russian-cyber-attack-against-the-country-of-georgia/index.html"
    },
    {
      "source_name": "mandiant_apt44_unearthing_sandworm",
      "url": "https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"
    },
    {
      "source_name": "US District Court Indictment GRU Unit 74455 October 2020",
      "url": "https://www.justice.gov/opa/press-release/file/1328521/download"
    },
    {
      "source_name": "Secureworks IRON VIKING ",
      "url": "https://www.secureworks.com/research/threat-profiles/iron-viking"
    },
    {
      "source_name": "UK NCSC Olympic Attacks October 2020",
      "url": "https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games"
    }
  ]
}

Explicit source assertions (14)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.