sandworm-team

name	sandworm-team
description	Adversary-emulation profile for Sandworm Team (Voodoo Bear / Seashell Blizzard / APT44 / ELECTRUM), Russia's GRU Unit 74455 destructive ICS/OT and influence actor (ATT&CK G0034).
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"sandworm, voodoo bear, seashell blizzard, apt44, electrum, telebots, iron viking, iridium, frozenbarents, gru unit 74455, G0034, industroyer, notpetya, olympic destroyer, blackenergy, killdisk, caddywiper, prestige, badpilot, ukraine power grid, ics ot destructive attack, microscada scilc, wiper malware emulation, russian gru destructive","tags":"adversary-emulation, threat-intel, mitre-attack, G0034, sandworm, apt44, seashell-blizzard, voodoo-bear, gru, russia, ics, ot, scada, destructive, wiper, ransomware, supply-chain, red-team","mitre_attack":"T1595.002, T1592.002, T1589.002, T1589.003, T1590.001, T1591.002, T1593, T1594, T1583.001, T1583.004, T1584.004, T1584.005, T1585.001, T1585.002, T1586.001, T1587.001, T1588.002, T1588.006, T1608.001, T1190, T1133, T1195, T1195.002, T1199, T1078, T1078.002, T1566.001, T1566.002, T1598.003, T1204.001, T1204.002, T1059.001, T1059.003, T1059.005, T1047, T1106, T1203, T1219, T1072, T1543.002, T1543.003, T1136.002, T1053.005, T1505.001, T1505.003, T1554, T1098, T1484.001, T1027, T1027.002, T1027.010, T1036, T1036.004, T1036.005, T1036.008, T1036.010, T1112, T1140, T1070.004, T1218.011, T1685, T1685.001, T1003.001, T1003.003, T1056.001, T1110, T1539, T1555.003, T1040, T1087.002, T1087.003, T1018, T1082, T1083, T1049, T1033, T1021.002, T1570, T1071.001, T1095, T1571, T1090, T1102.002, T1132.001, T1572, T1055, T1105, T1005, T1213.006, T1041, T1485, T1486, T1490, T1489, T1561.002, T1491.002, T1499"}

Sandworm Team (Voodoo Bear, Seashell Blizzard, ELECTRUM) — Adversary Emulation Profile

Sandworm Team (MITRE ATT&CK G0034; also tracked as APT44, Voodoo Bear, Seashell Blizzard, ELECTRUM, Telebots, IRON VIKING, IRIDIUM, FROZENBARENTS, and historically BlackEnergy/Quedagh) is a destructive Russian state threat group attributed to the GRU's Main Center for Special Technologies (GTsST), military unit 74455, active since at least 2009. Unlike espionage-focused peers, Sandworm is the GRU's premier sabotage and influence unit: it pairs conventional intrusion tradecraft with bespoke ICS/OT attack capability, disk wipers, fake ransomware, hacktivist-persona leaks, and disruptive operations timed to geopolitical and kinetic events. It is the only actor publicly documented to have triggered electric-grid blackouts via cyberattack (Ukraine, 2015 and 2016) and later repeated an OT grid attack in 2022. This profile maps Sandworm's signature TTPs to ATT&CK so Decepticon can emulate them within an authorized engagement and so the blue cell can anticipate detection.

Attribution & motivation

• Sponsor / nation: Russian Federation — GRU (Main Intelligence Directorate), Main Center for Special Technologies (GTsST), military unit 74455. Attribution is high confidence, backed by the October 2020 US DOJ indictment of six named Unit 74455 officers, concurrent UK/EU/Five Eyes statements, and Mandiant's April 2024 graduation of the cluster to the named APT designation APT44.
• Motivation: Primarily destructive/disruptive sabotage and influence operations in support of Russian military and political objectives, with espionage and pre-positioning for access as enabling activity. Financial theft is rare and generally a cover (e.g., NotPetya and Prestige used ransomware/wiper framing for destructive ends rather than profit).
• Strategic character: Operations are frequently synchronized with kinetic events (e.g., the October 2022 OT attack coincided with Russian missile strikes on Ukraine) and elections, and use false hacktivist or criminal personas for plausible deniability.

Targeting

• Sectors: Energy/electric utilities and ICS/OT operators (primary signature), oil and gas, government, defense and arms manufacturing, transportation and shipping, telecommunications, media, financial services, and civil society. The BadPilot subgroup (Microsoft, 2025) broadened opportunistic access into any Internet-facing enterprise software it can exploit.
• Regions: Heaviest focus on Ukraine and Russia's "near abroad" (e.g., Georgia, Poland, Kazakhstan). Global spillover and deliberate targeting includes Western Europe, the (expanded since early 2024 via BadPilot), and one-off high-impact events worldwide (e.g., the 2018 PyeongChang Winter Olympics, the OPCW, the 2017 French presidential campaign).