Procedure examples

Sandworm Team has used its plainpwd tool, a modified version of Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.

Sandworm Team has used `ntdsutil.exe` to back up the Active Directory database, likely for credential access.

Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.

Sandworm Team has copied payloads to the `ADMIN$` share of remote systems and run net use to connect to network shares.

Sandworm Team has used Base64 encoding within malware variants.

Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.

Sandworm Team has collected the username from a compromised host.

Sandworm Team masqueraded malicious installers as Windows update packages to evade defense and entice users to execute binaries.

Sandworm Team has avoided detection by naming a malicious binary explorer.exe.

Sandworm Team has used intercepter-NG to sniff passwords in network traffic.

Sandworm Team has sent system information to its C2 server using HTTP.

Sandworm Team has used Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.

Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.

Sandworm Team leveraged SHARPIVORY, a .NET dropper that writes embedded payload to disk and uses scheduled tasks to persist on victim machines.

Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.

Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.

Sandworm Team has created VBScripts to run an SSH server.

Sandworm Team has used backdoors that can delete files used in an attack from an infected system.

Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.

Sandworm Team has used the commercially available tool RemoteExec for agentless remote code execution.

Sandworm Team have used previously acquired legitimate credentials prior to attacks.

Sandworm Team has used stolen credentials to access administrative accounts within the domain.

Sandworm Team used a backdoor to enumerate information about the infected system's operating system.

Sandworm Team has enumerated files on a compromised host.

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.

Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.

Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.

Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor. Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.

Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.

Sandworm Team uses Prestige to disable and restore file system redirection by using the following functions: `Wow64DisableWow64FsRedirection()` and `Wow64RevertWow64FsRedirection()`.

Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.

Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.

Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.

Sandworm Team exploits public-facing applications for initial access and to acquire infrastructure, such as exploitation of the EXIM mail transfer agent in Linux systems.

Sandworm Team staged compromised versions of legitimate software installers on forums to achieve initial, untargetetd access in victim environments.

Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.

Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization. Additionally, Sandworm Team has accessed Internet service providers and telecommunication entities that provide mobile connectivity.

Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).

Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.

Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.

Sandworm Team exfiltrates data of interest from enterprise databases using Adminer.

Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.

Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.

Sandworm Team has used CaddyWiper, SDelete, and the BlackEnergy KillDisk component to overwrite files on victim systems. Additionally, Sandworm Team has used the JUNKMAIL tool to overwrite files with null bytes.

Sandworm Team has used Prestige ransomware to encrypt data at targeted organizations in transportation and related logistics industries in Ukraine and Poland.

Sandworm Team attempts to stop the MSSQL Windows service to ensure successful encryption of locked files.

Sandworm Team uses Prestige to delete the backup catalog from the target system using: `C:\Windows\System32\wbadmin.exe delete catalog -quiet` and to delete volume shadow copies using: `C:\Windows\System32\vssadmin.exe delete shadows /all /quiet`.

Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.

Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.