Sandworm Team
Essential information
- Confidence
- 100/100
- Published
- 16/12/2025 19:39
- Modified
- 27/03/2026 01:13
- Updated at
- 27/03/2026 01:13
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Resource level
- —
- Primary motivation
- —
- Related entities
- 100 attack patterns (mitre), 26 malware, 6 sectors, 5 countries, 22 indicators, 7 vulnerabilities (cve), 8 tool, 3 campaign
Aliases
ELECTRUM Telebots IRON VIKING BlackEnergy (Group) Quedagh Voodoo Bear FROZENBARENTS APT44 IRIDIUM Seashell Blizzard
Description
[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020)
In October 2020, the US indicted six GRU Unit 74455 officers associated with [Sandworm Team](https://attack.mitre.org/groups/G0034) for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide [NotPetya](https://attack.mitre.org/software/S0368) attack, targeting of the 2017 French presidential campaign, the 2018 [Olympic Destroyer](https://attack.mitre.org/software/S0365) attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as [APT28](https://attack.mitre.org/groups/G0007).(Citation: US District Court Indictment GRU Oct 2018)
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
- mitre-attack (G0034)
- NCSC Sandworm Feb 2020
- Microsoft Threat Actor Naming July 2023
- Secureworks IRON VIKING
- CrowdStrike VOODOO BEAR
- F-Secure BlackEnergy 2014
- mandiant_apt44_unearthing_sandworm
- InfoSecurity Sandworm Oct 2014
- Dragos ELECTRUM
- USDOJ Sandworm Feb 2020
- iSIGHT Sandworm 2014
- Leonard TAG 2023
- US District Court Indictment GRU Oct 2018
- UK NCSC Olympic Attacks October 2020
- Microsoft Prestige ransomware October 2022
- US District Court Indictment GRU Unit 74455 October 2020