Sandworm

    RussiaState-sponsoredUnknown

    Observation period

    0

    Techniques

    0

    Reports

    Latest observed activity
    No dated reports available
    First observed
    —

    Profile

    This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes. Some believe that the threat actor is linked to the 2015 compromise of the Ukrainian electrical grid and a distributed denial of service prior to the Russian invasion of Georgia. Believed to be responsible for the 2008 DDoS attacks in Georgia and the 2015 Ukraine power grid outage

    Relevance for Germany, Austria and Switzerland

    medium

    Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).

    Target sectors according to source

    • Private sector
    • Government

    Target countries according to source Russia, Lithuania, Kyrgyzstan, Israel, Ukraine, Belarus, Kazakhstan, Georgia, Poland, Azerbaijan, Iran

    Aliases

    • Quedagh
    • VOODOO BEAR
    • TEMP.Noble
    • IRON VIKING
    • ELECTRUM
    • TeleBots
    • IRIDIUM
    • Blue Echidna
    • FROZENBARENTS
    • UAC-0113
    • Seashell Blizzard
    • UAC-0082
    • APT44
    • SANDWORM RELIC
    • UAC-0145

    External references

    Back to group overview