Menu

Individual skill

sandworm

Sandworm (APT44 / Seashell Blizzard, GRU Unit 74455) adversary-emulation playbook — IT→OT intrusion ending in ICS manipulation or destructive impact, executed with living-off-the-land Windows tooling. SAFETY-CRITICAL: destructive and ICS-write steps are canary/lab-only and gated on explicit OT authorization. Use when emulating Sandworm against an ICS/OT or critical-infrastructure estate. Triggers on: 'emulate Sandworm', 'APT44', 'Seashell Blizzard', 'Voodoo Bear', 'ICS attack', 'OT destructive', 'Industroyer', 'NotPetya'.

packages/decepticon/decepticon/skills/standard/soundwave/threat-profile/emulation/sandworm/SKILL.md

Read pinned source

Source commit cc6044561ff32188dc0aa899bcc7d3666ffcfd1c

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
Yes
Observed behavior
Instructions only
Last checked
Nov 2, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
6,561
Repository last updated
Nov 7, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Declared tags are partial or unavailable.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Sandworm — Adversary Emulation Playbook

> Tier-3 Russian GRU (Unit 74455) sabotage actor. Sandworm's signature is a patient,
> living-off-the-land IT intrusion that **crosses the IT/OT boundary and ends in physical or
> data destruction** (Ukraine grid via Industroyer; NotPetya pseudo-ransomware wiper).
> **This is the highest-risk emulation in the catalog.** Every ICS-write and destructive step
> is canary/lab-only and gated on explicit operator + OT-engineer authorization.

## When to emulate Sandworm

- Target operates **ICS/OT** or critical infrastructure (energy, water, manufacturing,
  transportation) and the client wants the IT→OT kill chain and destructive-impact resilience
  tested — typically as a tabletop-plus or against a dedicated OT lab segment.
- The client's threat model includes destructive/disruptive nation-state actors (see the