Log in Request a demo

Threat group profile

Sandworm

Also known as Seashell Blizzard, Voodoo Bear, IRIDIUM

Attributed by the US, UK and EU governments to Russian military intelligence (GRU Unit 74455), this group is linked to the 2015 and 2016 power grid attacks in Ukraine, the 2017 NotPetya attack and the 2018 Winter Olympics attack.

In short

Attributed by the US, UK and EU governments to Russian military intelligence (GRU Unit 74455), this group is linked to the 2015 and 2016 power grid attacks in Ukraine, the 2017 NotPetya attack and the 2018 Winter Olympics attack. Its work is destructive: wipers and attacks on industrial control systems.

Last updated 7 October 2026

Profile MapThreat Group
  1. Attributed OriginRussia
  2. Names13names in public reportsSandworm Team · Telebots · Voodoo Bear
  3. Sectors8named as targetsEnergy · Government · Critical infrastructure
  4. Techniques14in the attack chainInitial Access · Persistence · Execution
  5. Tools11tools and malware listedBlackEnergy · Industroyer · NotPetya

In one minute

Who they are
Governments attribute Sandworm to Russian military intelligence, GRU Unit 74455 (GTsST). MITRE says it has been active since at least 2009.
Who they target
The UK says it mainly targets critical infrastructure, industrial control systems and Ukrainian military and government targets. Past victims named by governments also include Olympic organizers, French political groups and Georgian websites.
How they usually get in
Spearphishing, flaws in internet-facing servers such as Exim mail servers, and poisoned software updates, as described by the US, MITRE and the NCSC.
What stands out
Governments tie it to wipers and grid attacks, and to NotPetya, which the US says caused nearly 1 billion dollars in losses to three victims alone.
What to do first
Close internet access to router, firewall and server management pages, patch internet-facing mail servers, and make sure remote access needs multi-factor authentication.

Names

Public reports use several names for this activity.

Names used for Sandworm
NameWhere it appears
Sandworm Team MITRE ATT&CK G0034 (group name) and US indictment[1, 2]
Telebots MITRE ATT&CK; US indictment; UK statement of 19 October 2020; EU Implementing Regulation 2020/1125[1, 2, 3, 10]
Voodoo Bear MITRE ATT&CK; US indictment; EU Implementing Regulation 2020/1125[1, 2, 10]
Iron Viking MITRE ATT&CK (as IRON VIKING); US indictment[1, 2]
BlackEnergy Group MITRE ATT&CK (as BlackEnergy (Group)); UK statement of 19 October 2020; EU annex[1, 3, 10]
Quedagh MITRE ATT&CK; UK statement of 19 October 2020; EU annex[1, 3, 10]
ELECTRUM MITRE ATT&CK; UK statement of 19 October 2020[1, 3]
APT44 MITRE ATT&CK; UK profile of GRU cyber and hybrid threat operations[1, 12]
IRIDIUM MITRE ATT&CK (Associated Groups)[1]
Seashell Blizzard MITRE ATT&CK (Associated Groups)[1]
FROZENBARENTS MITRE ATT&CK (Associated Groups)[1]
GTsST, Main Center for Special Technologies, military unit 74455 MITRE; US indictment; UK; EU annex; CISA[1, 2, 3, 8, 10]
Olympic Destroyer EU Implementing Regulation 2020/1125 lists it as a name of the actor. MITRE and the US indictment treat it as a malware name.[10]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • US Department of Justice October 2020

    Indictment of six GRU officers working for Military Unit 74455, charged with conspiracy, computer hacking and wire fraud over NotPetya, the Ukraine grid attacks, Olympic Destroyer and other operations.[1, 2]

  • UK Foreign Office and NCSC 15 February 2018

    Judged that the Russian military was responsible for NotPetya of June 2017.[4]

  • UK Foreign Office and NCSC 19 October 2020

    Confirmed GTsST, field post number 74455, as responsible for the 2018 Winter Olympics attack, BlackEnergy, Industroyer, NotPetya and others.[3]

  • UK Foreign Office and NCSC 20 February 2020

    Said the GRU was almost certainly (95% or more) responsible for the 28 October 2019 Georgia attacks and named GTsST.[5]

  • UK NCSC 28 May 2020

    Supported a US advisory on GRU use of Exim flaw CVE-2019-10149 by the intrusion set Sandworm.[6]

  • EU Council 30 July 2020

    Listed GTsST (field post number 74455) under the EU cyber sanctions regime as responsible for cyber-attacks including NotPetya and the attack on a Ukrainian power grid.[10]

  • US CISA 20 July 2021

    Update to the 2015 Ukraine power outage alert: the US Government attributes the activity to Russian nation-state cyber actors.[13]

  • NCSC, CISA, NSA and FBI 23 February 2022

    Said the UK and US had previously attributed Sandworm to the Russian GRU, and described Cyclops Blink as a Sandworm tool.[7]

  • CISA, Australia, Canada, New Zealand and the UK 9 May 2022 (revision date)

    Described GTsST (Unit 74455) in a joint advisory on Russian threats to critical infrastructure.[8]

  • NCSC and partners 31 August 2023

    Published a report supporting the SBU's attribution of Infamous Chisel to Sandworm, and said the NCSC had previously attributed Sandworm to GTsST.[9]

  • Security Service of Ukraine (reported by the UK) undated UK profile, covering December 2023

    Named Unit 74455 for the Kyivstar operation of December 2023.[12]

  • ANSSI (France) 27 January 2021

    Said a campaign against Centreon software from late 2017 to 2020 showed similarities with earlier Sandworm campaigns.[11]

Where sources differ

Sources differ on several points. First, names: MITRE and the US indictment treat Olympic Destroyer as malware, while the EU Implementing Regulation 2020/1125 lists "Olympic Destroyer" among the actor's names. Second, the year the UK first attributed events: the UK profile of GRU cyber units says the UK attributed Industroyer and BlackEnergy in 2016 and 2015, the Olympics in 2019 and Georgia in 2020, while the UK statement of 19 October 2020 says the UK was "confirming for the first time" that GTsST was responsible for those operations, and lists exposure dates of February 2018 (NotPetya), February 2020 (BlackEnergy, Industroyer, Georgia) and October 2018 (BadRabbit).

The UK profile gives 2017 for BadRabbit. Third, the 2015 outage size: the US indictment says more than 225,000 customers, and the UK says 230,000 people. MITRE says some operations had help from Unit 26165 (APT28), while the UK profile lists the two units separately. ANSSI does not name a unit, it only reports similarities with Sandworm campaigns.

Who they target

Sectors

  • EnergyThe US indictment names Ukrainian power distribution companies in December 2015 and an electric company in December 2016. CISA and partners name Ukrainian energy distribution companies.[2, 8]
  • GovernmentThe US indictment names Ukraine's Ministry of Finance and State Treasury Service. The UK names Georgian government bodies.[2, 3]
  • Critical infrastructureThe UK says Unit 74455 principally targets critical national infrastructure and industrial control systems.[12]
  • HealthcareThe indictment names a Pennsylvania health system with about 80 affected medical facilities as a NotPetya victim.[2]
  • Transport and logisticsMITRE says Prestige ransomware hit transportation and logistics firms in Ukraine and Poland. UK lists BadRabbit disruption at Kyiv metro and Odessa airport.[1, 3]
  • Sport and eventsThe indictment names Olympic partners, athletes, the IOC and Olympic IT systems in 2017 and 2018.[2]
  • MediaThe indictment names a Georgian media outlet. The UK says Georgian national broadcasters were interrupted.[2, 5]
  • IT and web hostingANSSI says a campaign from late 2017 to 2020 mostly affected IT providers, especially web hosting providers.[11]

Regions

  • UkraineMain focus of grid, finance, government and military targeting per US, UK and CISA.[2, 12, 8]
  • GeorgiaThe indictment and UK say about 15,000 sites were defaced on 28 October 2019 after a hosting provider was compromised.[2, 5]
  • FranceThe indictment names spearphishing against local government, parties and the 2017 Macron campaign. ANSSI reports a later Centreon campaign hitting French entities.[2, 11]
  • South KoreaThe indictment names PyeongChang Organizing Committee systems and Korean government agencies.[2]
  • United KingdomA GOV.UK profile, updated 13 July 2026, says GRU Unit 74455, also known as APT44 or Sandworm, with Unit 26165 attempted intrusions into the Foreign, Commonwealth and Development Office (March 2018) and the Defense, Science and Technology Laboratory (April 2018).[12]
  • PolandMITRE ATT&CK says Sandworm Team used Prestige ransomware against organizations in transportation and related logistics industries in Ukraine and Poland.[2]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. At least 2009

    Earliest date given

    MITRE and CISA with partners say the group has been active since at least 2009.[1, 8]

  2. December 2015

    Ukraine power outage

    The US indictment says the group cut power to more than 225,000 customers by hacking three distribution companies on or about 23 December 2015.[2]

  3. December 2016

    Industroyer and Ukrainian finance systems

    The US indictment says Industroyer cut power to Kyiv for about one hour on or about 17 December 2016, and that Ministry of Finance systems were hit on or about 6 December 2016.[2]

  4. April to May 2017

    French election phishing

    The US indictment says the group spearphished French local government, parties and the Macron campaign.[2]

  5. 27 June 2017

    NotPetya

    The US indictment says NotPetya started on or about 27 June 2017 through a poisoned update of Ukrainian tax software.[2]

  6. October 2017

    BadRabbit

    The UK says BadRabbit ransomware disrupted the Kyiv metro and Odessa airport.[3]

  7. December 2017 to February 2018

    Olympic spearphishing and Olympic Destroyer

    The US indictment says spearphishing from December 2017 and the Olympic Destroyer wiper in February 2018.[2]

  8. April 2018

    OPCW and Dstl phishing

    The US indictment says the group spearphished the OPCW and the UK's Dstl.[2]

  9. Late 2017 to 2020

    Centreon campaign

    ANSSI reported a campaign against monitoring software that hit French IT and hosting providers.[11]

  10. June 2019

    Cyclops Blink deployment begins

    The 2022 advisory says Cyclops Blink had been deployed since at least June 2019.[7]

  11. October 2019

    Georgia defacement

    The US and UK say about 15,000 sites were defaced on 28 October 2019.[2, 5]

  12. June to October 2022

    2022 Ukraine power attack

    MITRE records a 2022 Ukraine electric power campaign with CaddyWiper use.[1]

  13. November 2022

    Industroyer2

    The UK said its Ukraine program helped protect Ukrainian bodies against destructive attacks including Industroyer2.[14]

  14. August 2023

    Infamous Chisel

    The NCSC said the malware targeted Ukrainian military Android devices and was attributed to Sandworm.[9]

  15. December 2023

    Kyivstar

    The UK profile says the SBU named Unit 74455 for an operation against Kyivstar.[12]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about Sandworm
DateWhoWhat
15 February 2018 UK Foreign Office and NCSC Public attributionJudged the Russian military responsible for NotPetya.[4]
20 February 2020 UK Foreign Office and NCSC Public attributionExposed GRU responsibility for the October 2019 Georgia attacks.[5]
28 May 2020 UK NCSC Support for US advisoryBacked a US advisory on GRU exploitation of Exim flaw CVE-2019-10149 and advised updating Exim.[6]
30 July 2020 EU Council Cyber sanctions listingListed GTsST under the EU cyber sanctions regime (Implementing Regulation 2020/1125).[10]
October 2020 US Department of Justice IndictmentCharged six GRU officers working for Unit 74455 with conspiracy, computer hacking and wire fraud.[1, 2]
19 October 2020 UK Foreign Office and NCSC Public attributionConfirmed GTsST responsibility for the Olympic Destroyer attack and other operations.[3]
27 January 2021 ANSSI Technical reportPublished a report on the Centreon campaign with recommendations.[11]
20 July 2021 US CISA Alert updateStated the US Government attributes the 2015 outage to Russian nation-state actors.[13]
23 February 2022 NCSC, CISA, NSA, FBI Joint advisoryDescribed Cyclops Blink and gave mitigations.[7]
9 May 2022 CISA with Australia, Canada, New Zealand, UK Joint advisory (revision date)Described GTsST (Unit 74455) and listed protective actions for critical infrastructure.[8]
1 November 2022 UK Government Support packageAnnounced Ukraine cyber program support including against Industroyer2.[14]
31 August 2023 NCSC and partners Malware reportPublished a report on Infamous Chisel supporting the SBU attribution to Sandworm.[9]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Initial Access

  • Phishing T1566

    The US indictment says spearphishing emails with malware-laced files hit Ukrainian energy staff in 2015, and French, Olympic and OPCW targets later.[1, 2]

  • Exploit Public-Facing Application T1190

    MITRE says the group exploited the Exim mail transfer agent on Linux servers. The NCSC supported a US advisory on this.[1, 6]

  • Supply Chain Compromise T1195

    MITRE and the US indictment say NotPetya was spread through a poisoned update of Ukrainian accounting software M.E.Doc.[1, 2]

  • Trusted Relationship T1199

    MITRE says the group used connections from one victim to reach another organization.[1]

  • Valid Accounts T1078

    MITRE says the group used legitimate credentials acquired before attacks. The indictment says stolen credentials opened the SCADA networks.[1, 2]

Execution

  • Command and Scripting Interpreter T1059

    MITRE lists PowerShell, command prompt and Visual Basic scripting use.[1]

Persistence

  • External Remote Services T1133

    MITRE says the group used VPN tunnels and Dropbear SSH for access. The Cyclops Blink advisory says modified firmware was deployed through an exposed service.[1, 7]

Credential Access

  • OS Credential Dumping T1003

    MITRE lists credential dumping tools.[1]

Lateral Movement

  • Remote Services T1021

    MITRE lists use of SMB and Windows admin shares.[1]

Impact

  • Data Destruction T1485

    MITRE says the group used CaddyWiper, SDelete and KillDisk to overwrite files.[1]

  • Disk Wipe T1561

    MITRE lists KillDisk corrupting the master boot record. The indictment says KillDisk was used at the end of the 2015 attacks.[1, 2]

  • Data Encrypted for Impact T1486

    MITRE says Prestige ransomware encrypted data in Ukraine and Poland.[1]

  • Inhibit System Recovery T1490

    MITRE says Prestige deletes backups and shadow copies.[1]

  • Defacement T1491

    MITRE and the US indictment describe the roughly 15,000 Georgian sites defaced in 2019.[1, 2]

Tools and malware

  • BlackEnergy Modular malware

    Used to steal credentials before the 2015 Ukraine power outage, with its KillDisk component wiping systems.[1, 2, 8]

  • Industroyer ICS malware

    Built to attack power grids. Used in December 2016 according to the US, UK and CISA.[1, 2, 8]

  • NotPetya Wiper posing as ransomware

    Spread in June 2017 through an update of M.E.Doc software.[1, 2, 8]

  • Olympic Destroyer Wiper

    Used against Olympic IT systems in February 2018.[1, 2, 3]

  • Cyclops Blink Network device malware

    A modular framework for network devices that replaced VPNFilter, deployed since at least June 2019.[1, 7]

  • Bad Rabbit Ransomware

    The UK says it disrupted the Kyiv metro and Odessa airport in October 2017.[1, 3]

  • CaddyWiper Wiper

    MITRE says it was used to wipe files in Ukraine, including in a 2022 power attack.[1]

  • Prestige Ransomware

    MITRE says it hit transport and logistics firms in Ukraine and Poland.[1]

  • P.A.S. Webshell Web shell

    Found by ANSSI on Centreon servers, and listed by MITRE.[1, 11]

  • AcidRain Wiper

    MITRE links it to a 2022 satellite modem incident.[1]

  • Infamous Chisel Android malware

    Targets Ukrainian military Android devices per the NCSC and partners, in August 2023.[9]

Also linked in our threat library:

Detection and defense

  1. Close management pages to the internet

    Keep router, firewall and server admin pages off the internet. The Cyclops Blink advisory says to ensure management interfaces are not exposed.

    Counters T1133 T1190

  2. Patch mail and internet-facing servers

    Update Exim to 4.93 or newer as the NCSC advises, and patch known exploited flaws first.

    Counters T1190

  3. Require multi-factor authentication on remote access

    Enforce multi-factor authentication on VPN, remote desktop and admin accounts, as CISA and partners urge.

    Counters T1078 T1133 T1021

  4. Replace passwords after any device compromise

    If a network device is found infected, assume its stored passwords are stolen and replace them.

    Counters T1078 T1003

  5. Train staff on phishing

    Give end users awareness training. The indictment shows IT staff and administrators were the first targets.

    Counters T1566

  6. Check vendor software and partner links

    Treat software updates and links to partners as an entry route. NotPetya came through a poisoned update.

    Counters T1195 T1199

  7. Keep control systems apart from the internet

    Isolate industrial control networks from untrusted networks and plan a safe shutdown, as CISA advised after 2015.

    Counters T1021 T1485

  8. Keep offline backups and a recovery plan

    Keep offline backups, test restores and have a recovery plan against wipers and ransomware, as CISA and partners advised in May 2022.

    Counters T1485 T1561 T1486 T1490

What Brandefense can do

Questions

Who is Sandworm?

The US, UK and EU governments attribute it to Russian military intelligence, GRU Unit 74455 (GTsST). MITRE says it has been active since at least 2009.

Are they still active?

The latest government items used for this page are the August 2023 Infamous Chisel report and a UK profile of GRU cyber units that still lists Unit 74455. The Security Service of Ukraine is reported to have named the unit for the December 2023 Kyivstar operation.

Who do they target?

The UK says critical infrastructure, industrial control systems and Ukrainian military and government targets. Governments also list Olympic organizers, French political groups, Georgian sites and global NotPetya victims.

How do they get in?

The US indictment describes spearphishing. MITRE adds exploits of mail servers, poisoned software updates and use of trusted links between victims. For network devices the 2022 advisory describes modified firmware.

How can I tell if I am a target?

Governments name energy, government, logistics, media and IT hosting firms. If you use Exim, Centreon or exposed network devices named in the advisories, check them first.

What should I do first?

Take router and server management pages off the internet, patch mail servers, require multi-factor authentication, and keep offline backups.

In our research

  1. ATT&CK groups by attributed origin: what is mapped October 2026
  2. Vulnerability Exploitation Trends: H1 2026: What Threat Actors Are Actually Using June 2026
  3. Sandworm (APT44): Russia’s Most Destructive Cyber Weapon November 2025
  4. Geopolitical Countdown: The Evolution of Cyberspace from Espionage to Destruction and New Strategies for Corporate Resilience November 2025
  5. EASM Best Practices for the Energy Sector October 2025
  6. Innovative Solutions to EASM Challenges for 2026 October 2025
  7. Gamaredon Group: A Persistent Russian Espionage Threat September 2025
  8. How Nation-State Cyber Threats Are Evolving – Part I August 2025

Sources

  1. United States of America v. Yuriy Sergeyevich Andrienko et al. (indictment) US Department of Justice Supports: Unit 74455, aliases, six officers, victims, NotPetya, Industroyer, Olympic Destroyer, Georgia
  2. Sandworm Team (G0034) MITRE ATT&CK Supports: Group name, since 2009, aliases, techniques, software
  3. UK exposes series of Russian cyber attacks against Olympic and Paralympic Games UK Foreign, Commonwealth and Development Office Supports: GTsST attribution, names, Olympic Destroyer, BadRabbit, 19 October 2020
  4. Foreign Office Minister condemns Russia for NotPetya attacks UK Foreign and Commonwealth Office and NCSC Supports: NotPetya attribution to the Russian military, 15 February 2018
  5. UK condemns Russia's GRU over Georgia cyber-attacks UK Foreign and Commonwealth Office and NCSC Supports: Georgia attribution, 20 February 2020
  6. NCSC supports US advisory regarding GRU intrusion set Sandworm UK National Cyber Security Centre Supports: Exim CVE-2019-10149, 28 May 2020
  7. New Sandworm Malware Cyclops Blink Replaces VPNFilter (AA22-054A) CISA, NCSC, NSA, FBI Supports: Cyclops Blink, mitigations, 23 February 2022
  8. Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure (AA22-110A) CISA, with Australia, Canada, New Zealand, UK Supports: GTsST description, 2015 to 2017 operations, actions
  9. UK and allies support Ukraine calling out Russia's GRU for new malware campaign UK National Cyber Security Centre Supports: Infamous Chisel, 31 August 2023
  10. Council Implementing Regulation (EU) 2020/1125 of 30 July 2020 (Official Journal L 246) Council of the European Union via EUR-Lex Supports: EU listing of GTsST on 30 July 2020 and the names of the actor
  11. Sandworm intrusion set campaign targeting Centreon systems (CERTFR-2021-CTI-005) ANSSI (France) Supports: Centreon campaign 2017 to 2020, 27 January 2021
  12. Profile: GRU cyber and hybrid threat operations UK Government Supports: Unit 74455 profile, Kyivstar, France, 2026
  13. Cyber-Attack Against Ukrainian Critical Infrastructure (IR-ALERT-H-16-056-01) CISA Supports: 2015 outage, US attribution update of 20 July 2021
  14. UK boosts Ukraine's cyber defences with 6 million pound support package UK Government Supports: Industroyer2 support, 1 November 2022

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Industry

Energy and utilities

Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.

Read more

Role

SOC and CTI analyst

Give every alert the context it lacks, track the groups that matter to you and spend less time switching between tabs.

Read more