Sandworm TeamG0034 state

About this actor

[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020) In October 2020, the US indicted six GRU Unit 74455 officers associated with [Sandworm Team](https://attack.mitre.org/groups/G0034) for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide [NotPetya](https://attack.mitre.org/software/S0368) attack, targeting of the 2017 French presidential campaign, the 2018 [Olympic Destroyer](https://attack.mitre.org/software/S0365) attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as [APT28](https://attack.mitre.org/groups/G0007).(Citation: US District Court Indictment GRU Oct 2018)

Source: MITRE ATT&CK

Activity timeline

• 2026 — 1 CVE published
• 2022 — 1 KEV added
• 2010 — 1 CVE published

Profile

Mitigating controls (NIST 800-53)

Co-occurring actors

• Naikon 1 shared CVEs
• Scarlet Mimic 1 shared CVEs
• Transparent Tribe 1 shared CVEs
• Aoqin Dragon 1 shared CVEs
• Mustang Panda 1 shared CVEs
• SolarWinds Compromise 1 shared CVEs
• APT38 1 shared CVEs
• Tonto Team 1 shared CVEs
• Ember Bear 1 shared CVEs
• GOLD SOUTHFIELD 1 shared CVEs

Similar actors