US District Court Indictment GRU Unit 74455 October 2020

Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.

Sandworm Team has collected the username from a compromised host.

Sandworm Team has avoided detection by naming a malicious binary explorer.exe.

Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.

Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.

Sandworm Team has used stolen credentials to access administrative accounts within the domain.

Sandworm Team used a backdoor to enumerate information about the infected system's operating system.

NotPetya searches for files ending with dozens of different file extensions prior to encryption.

Sandworm Team has enumerated files on a compromised host.

Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.

Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.

Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization. Additionally, Sandworm Team has accessed Internet service providers and telecommunication entities that provide mobile connectivity.

Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.

Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.

NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network.

Olympic Destroyer overwrites files locally and on remote shares.

NotPetya encrypts user files and disk structures like the MBR with 2048-bit RSA.

Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.

Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.

NotPetya determines if specific antivirus programs are running on an infected host machine.

NotPetya will reboot the system one hour after infection.

Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.

Sandworm Team has delivered malicious Microsoft Office and ZIP file attachments via spearphishing emails.

Sandworm Team has crafted phishing emails containing malicious hyperlinks.

Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages, while also hosting these items on legitimate, compromised network infrastructure.

Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.

Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.

Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.

Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.

Sandworm Team has acquired open-source tools for their operations, including Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as Impacket and RemoteExec, which were used in their 2022 Prestige operations. Additionally, Sandworm Team has used Empire, Cobalt Strike and PoshC2.

In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.

Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.

Sandworm Team's research of potential victim organizations included the identification and collection of employee information.

Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.

In preparation for its attack against the 2018 Winter Olympics, Sandworm Team conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.

Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.

Sandworm Team researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the NotPetya attack. Sandworm Team has also researched third-party websites to help it craft credible spearphishing emails.

Sandworm Team has conducted research against potential victim websites as part of its operational planning.

Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.

Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.

NotPetya uses wevtutil to clear the Windows event logs.