not MITRE’s ATT&CK Group
Sandworm Team
How MITRE ATT&CK characterizes this group1: Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455. This group has been active since at least 2009. In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government…
Attributed to Russia — GRU (Unit 74455, Main Centre for Special Technologies) by government advisory.112113
Read as a state-directed operator, not a smash-and-grab.
A nation-state classification means patience, tradecraft, and an intelligence objective. When this name attaches to a vulnerability, the question shifts from “will someone exploit it” to “has a well-resourced service already built it into an operation.” All tradecraft below is sourced to MITRE ATT&CK.
Known for
— signature moves, each sourced to ATT&CKTradecraft heatmap
— ATT&CK techniques mapped onto the five attacker-outcome narrativesEach row is a documented technique (MITRE ATT&CK). Each column is one of the five attacker-outcome narratives a defender funds against. A filled cell means this technique’s own ATT&CK tactic defensibly advances that outcome. The mapping of technique→outcome is our editorial alignment over ATT&CK's tactic data, not a separately-sourced MITRE edge. A filled cell means one of the technique's own ATT&CK tactics defensibly advances that outcome; enabler tactics (C2, Defense Evasion, Discovery) heat no column.
Reach: this actor’s cited techniques light columns 1·2·3·4·5 — furthest is 5 · Lights out. (furthest-position idiom, reused from the landing map).
Arsenal
— named tools & malware ATT&CK attributes to this groupATT&CK attributes 27 tools/malware to G0034 in total; the full list is on the group page.
Campaign highlights
— attributed operations in the ATT&CK record2016 Ukraine Electric Power Attack — ATT&CK Campaign C0025
2015 Ukraine Electric Power Attack — ATT&CK Campaign C0028
2022 Ukraine Electric Power Attack — ATT&CK Campaign C0034
Latest activity
— with explicit confidence, and what we cannot yet claimsnapshot
The most recent cited activity in this card is the ATT&CK record itself. We do not paste a “last seen this week” line we cannot source. Recency from secondary reporting appears here only when attached to a named advisory.