sandworm-team

• SKILL.mdcore · 19,888 bytes

# Sandworm Team (Voodoo Bear, Seashell Blizzard, ELECTRUM) — Adversary Emulation Profile

Sandworm Team (MITRE ATT&CK **G0034**; also tracked as APT44, Voodoo Bear, Seashell Blizzard, ELECTRUM, Telebots, IRON VIKING, IRIDIUM, FROZENBARENTS, and historically BlackEnergy/Quedagh) is a destructive Russian state threat group attributed to the GRU's Main Center for Special Technologies (GTsST), military unit 74455, active since at least 2009. Unlike espionage-focused peers, Sandworm is the GRU's premier *sabotage and influence* unit: it pairs conventional intrusion tradecraft with bespoke ICS/OT attack capability, disk wipers, fake ransomware, hacktivist-persona leaks, and disruptive operations timed to geopolitical and kinetic events. It is the only actor publicly documented to have triggered electric-grid blackouts via cyberattack (Ukraine, 2015 and 2016) and later repeated an OT grid attack in 2022. This profile maps Sandworm's signature TTPs to ATT&CK so Decepticon can emulate them within an authorized engagement and so the blue cell can anticipate detection.

## Attribution & motivation

- **Sponsor / nation:** Russian Federation — GRU (Main Intelligence Directorate), Main Center for Special Technologies (GTsST), military unit **74455**. Attribution is **high confidence**, backed by the October 2020 US DOJ indictment of six named Unit 74455 officers, concurrent UK/EU/Five Eyes statements, and Mandiant's April 2024 graduation of the cluster to the named APT designation **APT44**.
- **Motivation:** Primarily **destructive/disruptive sabotage** and **influence operations** in support of Russian military and political objectives, with **espionage** and pre-positioning for access as enabling activity. Financial theft is rare and generally a cover (e.g., NotPetya and Prestige used ransomware/wiper framing for destructive ends rather than profit).
- **Strategic character:** Operations are frequently synchronized with kinetic events (e.g., the October 2022 OT attack coincided with Russian missile strikes on Ukraine) and elections, and use false hacktivist or criminal personas for plausible deniability.

## Targeting

- **Sectors:** Energy/electric utilities and ICS/OT operators (primary signature), oil and gas, government, defense and arms manufacturing, transportation and shipping, telecommunications, media, financial services, and civil society. The BadPilot subgroup (Microsoft, 2025) broadened opportunistic access into any Internet-facing enterprise software it can exploit.
- **Regions:** Heaviest focus on **Ukraine** and Russia's "near abroad" (e.g., Georgia, Poland, Kazakhstan). Global spillover and deliberate targeting includes Western Europe, the **United States and United Kingdom** (expanded since early 2024 via BadPilot), and one-off high-impact events worldwide (e.g., the 2018 PyeongChang Winter Olympics, the OPCW, the 2017 French presidential campaign).