Procedure examples

Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.

Sandworm Team used information stealer malware to collect browser session cookies.

Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.

Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.

Sandworm Team has delivered malicious Microsoft Office and ZIP file attachments via spearphishing emails.

Sandworm Team has crafted phishing emails containing malicious hyperlinks.

Sandworm Team has used `move` to transfer files to a network share and has copied payloads--such as Prestige ransomware--to an Active Directory Domain Controller and distributed via the Default Domain Group Policy Object. Additionally, Sandworm Team has transferred an ISO file into the OT network to gain initial access.

Sandworm Team has used port 6789 to accept connections on the group's SSH server.

Sandworm Team used various third-party email campaign management services to deliver phishing emails.

Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages, while also hosting these items on legitimate, compromised network infrastructure.

Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.

Sandworm Team compromised legitimate Linux servers running the EXIM mail transfer agent for use in subsequent campaigns.

Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.

Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.

Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.

Sandworm Team creates credential capture webpages to compromise existing, legitimate social media accounts.

Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.

Sandworm Team has acquired open-source tools for their operations, including Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as Impacket and RemoteExec, which were used in their 2022 Prestige operations. Additionally, Sandworm Team has used Empire, Cobalt Strike and PoshC2.

In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.

Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.

Sandworm Team's research of potential victim organizations included the identification and collection of employee information.

Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.

In preparation for its attack against the 2018 Winter Olympics, Sandworm Team conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.

Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.

Sandworm Team researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the NotPetya attack. Sandworm Team has also researched third-party websites to help it craft credible spearphishing emails.

Sandworm Team has conducted research against potential victim websites as part of its operational planning.

Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.

Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.

Sandworm Team staged compromised versions of legitimate software installers in forums to enable initial access to executing user.