Cyber Posture

Threat actor · all actors

Sandworm TeamG0034 state

🇷🇺 RU · GRU · Unit 74455

aka Sandworm Team, ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group), Quedagh, Voodoo Bear, IRIDIUM, Seashell Blizzard, FROZENBARENTS, APT44, Sandworm, TEMP.Noble, G0034, Blue Echidna, UAC-0113, UAC-0082

Last updated: 2026-06-02

22attributed CVEs
109ATT&CK techniques
62.9IDF score (tooling uniqueness)
0exclusive CVEs
2010–2026years active

About this actor

[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020) In October 2020, the US indicted six GRU Unit 74455 officers associated with [Sandworm Team](https://attack.mitre.org/groups/G0034) for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide [NotPetya](https://attack.mitre.org/software/S0368) attack, targeting of the 2017 French presidential campaign, the 2018 [Olympic Destroyer](https://attack.mitre.org/software/S0365) attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as [APT28](https://attack.mitre.org/groups/G0007).(Citation: US District Court Indictment GRU Oct 2018)

Source: MITRE ATT&CK

Activity timeline

Find actors who…

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2010-3333 KEV0.37.80.00002010-11-10see CVE
CVE-2014-4114 KEV0.37.80.00002014-10-15see CVE
CVE-2018-13379 KEV0.39.10.00002019-06-04see CVE
CVE-2019-10149 KEV0.39.80.00002019-06-05see CVE
CVE-2019-11510 KEV0.310.00.00002019-05-08see CVE
CVE-2019-1653 KEV0.37.50.00002019-01-24see CVE
CVE-2019-19781 KEV0.39.80.00002019-12-27see CVE
CVE-2019-2725 KEV0.39.80.00002019-04-26see CVE
CVE-2019-7609 KEV0.310.00.00002019-03-25see CVE
CVE-2019-9670 KEV0.39.80.00002019-05-29see CVE
CVE-2020-0688 KEV0.38.80.00002020-02-11see CVE
CVE-2020-1472 KEV0.35.50.00002020-08-17see CVE
CVE-2020-14882 KEV0.39.80.00002020-10-21see CVE
CVE-2020-4006 KEV0.39.10.00002020-11-23see CVE
CVE-2020-5902 KEV0.39.80.00002020-07-01see CVE
CVE-2021-26855 KEV0.39.10.00002021-03-03see CVE
CVE-2021-26857 KEV0.37.80.00002021-03-03see CVE
CVE-2021-26858 KEV0.37.80.00002021-03-03see CVE
CVE-2021-27065 KEV0.37.80.00002021-03-03see CVE
CVE-2021-4034 KEV0.37.80.00002022-01-28see CVE
CVE-2022-30190 KEV0.37.80.00002022-06-01see CVE
CVE-2026-20929 0.07.50.00002026-01-13see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-464 / 10959%
CM-653 / 10949%
CM-250 / 10946%
SI-347 / 10943%
AC-342 / 10939%
CA-742 / 10939%
CM-740 / 10937%
AC-639 / 10936%
AC-432 / 10929%
SC-730 / 10928%
SI-730 / 10928%
AC-228 / 10926%
IA-221 / 10919%
AC-520 / 10918%
CM-519 / 10917%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category