Sandworm Threat Actor Profile: Destructive Attacks on Critical Infrastructure

Sandworm is the Russian military intelligence unit behind most of the destructive cyber attacks of the past decade, from Ukraine's blackouts to NotPetya, and it now reaches energy targets inside the EU. This profile is for defenders in energy, utilities, telecoms, logistics and government, and for any organisation with operations, suppliers or customers in Ukraine. It summarises who the group is, what it goes after, the ATT&CK techniques that matter for detection, how it turns domain credentials and Group Policy into a wiper delivery system, and what to do about it. It sits under the broader Threat Actor Groups Guide, which covers how to use actor profiles in general; this page is specific to Sandworm. Attacker tooling is described only as far as defenders need it.

Key takeaways

• Sandworm is GRU Unit 74455. MITRE ATT&CK (G0034) and a 2020 US indictment attribute it to the GRU Main Center for Special Technologies, active since at least 2009.
• Destruction is the goal, not a side effect. Its signature operations wipe data or open circuit breakers: Ukraine's grid in 2015, 2016 and 2022, NotPetya in 2017 and attempted wiper attacks on Polish energy sites in December 2025.
• Domain control is the delivery system. Once it holds a domain controller it pushes wipers with Group Policy and scheduled tasks, so a compromised Tier 0 account becomes a company-wide kill switch.
• Edge devices and exposed services open the door. Internet-facing mail, VPN, remote management and network appliances are the usual way in, and Microsoft reports a dedicated access subgroup harvesting footholds globally since 2021.
• Recovery capability is the decisive control. Offline backups, an isolated rebuild path for Active Directory and OT that keeps running when IT is wiped matter more than any single detection.

Who they are (names and aliases)

MITRE ATT&CK tracks the group as Sandworm Team (G0034) and attributes it to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST), military unit 74455. In October 2020 the US Department of Justice charged six Unit 74455 officers over the Ukraine grid and finance ministry attacks of 2015 and 2016, NotPetya, the French election hack-and-leak of 2017, Olympic Destroyer, targeting of the OPCW in 2018 and attacks on Georgia in 2018 and 2019. In April 2024 Mandiant graduated the group to a numbered designation, APT44, describing it as sponsored by Russian military intelligence and combining espionage, attack and influence operations.

Vendor names do not map perfectly to one another. Treat them as overlapping clusters, and check which cluster a report means before merging indicators.

Targeting and motivation

Sandworm's activity follows Russian state military priorities. Mandiant describes Ukraine as its principal focus, with operations elsewhere wherever Russian national interests are at stake, including elections and international bodies investigating Russia.

• Energy and utilities: Ukrainian distribution and transmission operators (2015, 2016, 2022) and, according to ESET, two Polish combined heat and power plants and a renewable energy management system in December 2025.
• Telecoms and internet providers: Dragos reports a coordinated attack on eight Ukrainian ISPs in May 2025.
• Government, logistics, agriculture and education: ESET reported wiper attacks on Ukrainian government, energy, logistics and grain sector organisations in June and September 2025, and on a university in April 2025.
• Global opportunistic access: Microsoft reports that a Seashell Blizzard subgroup moved from mainly Ukrainian targets in 2022 to the United States, Canada, Australia and the United Kingdom in 2024, often through opportunistic exploitation of exposed systems in energy, oil and gas, telecoms, shipping, arms manufacturing and government.
• Collateral victims: NotPetya, which ATT&CK associates with software supply chain compromise, hit companies worldwide; the indictment says three named victims alone lost nearly $1 billion.

The practical consequence: if you are not a direct target, you can still be hit through a supplier, a shared network or a self-propagating payload.

Tactics and techniques (MITRE ATT&CK)

The table lists techniques that ATT&CK v20 maps to Sandworm Team (G0034) and that defenders can act on. Group Policy Modification is drawn from Mandiant and ESET incident reports rather than the ATT&CK group mapping.

In OT, Mandiant's analysis of the October 2022 Ukrainian outage found no new malware: the group mounted an ISO image on a SCADA virtual machine and used the native MicroSCADA utility scilc.exe to send commands, a "living off the land" approach in OT. Earlier payloads, Industroyer (2016) and Industroyer2 (2022), spoke grid protocols directly; ESET found Industroyer2 implemented only IEC 60870-5-104. Network device malware also features: VPNFilter and its successor Cyclops Blink built botnets on WatchGuard and ASUS devices, which the US disrupted in 2018 and March 2022. See the Wiper Malware Guide for the wider wiper family.

How they abuse identities and credentials

Sandworm's destructive operations depend on identity more than on exotic malware. The pattern across incident reports is consistent: get a foothold, collect credentials, reach domain administrator, then use the domain's own management plane to destroy it.

• Harvesting at the edge: Microsoft reports the BadPilot subgroup injected JavaScript into Outlook Web Access sign-in pages to capture usernames and passwords in clear text, and used renamed procdump and reg.exe to dump LSASS and registry hives.
• Valid VPN accounts: CERT Polska found that the December 2025 Polish energy intrusions began at internet-exposed FortiGate VPN interfaces that allowed logins without multi-factor authentication (CERT Polska's own attribution of these intrusions differs from ESET's, see below).
• Group Policy as a weapon: Mandiant documented the TANKTRAP PowerShell utility creating GPOs that copied CaddyWiper to C:\Windows\msserver.exe and created scheduled tasks to run it. ESET saw the same GPO approach at a Ukrainian bank in 2022, and CERT Polska reports DynoWiper and LazyWiper were pushed through GPOs from a domain controller in 2025.
• Remote management agents as non-human identities: after exploiting ScreenConnect or FortiClient EMS, the subgroup installed Atera and Splashtop agents, which then authenticate as trusted software. Microsoft also reports Tor hidden services forwarding RDP ("ShadowLink").
• Shared OT credentials and weak defaults: the MicroSCADA host in 2022 was end of life and allowed default access to its SCIL API, which has been disabled by default since MicroSCADA 9.4 according to Mandiant.

The defensive conclusion is that Tier 0 (domain controllers, GPO editing rights, identity infrastructure) and management agents must be treated as the crown jewels. See the Tiered Administration and Enterprise Access Model Guide and the Credential Dumping Guide.

Notable incidents

Attribution note on Poland: ESET and Dragos link the December 2025 activity to Sandworm/ELECTRUM, and Poland's prime minister said everything indicated groups directly linked to Russian services. Reporting on CERT Polska's February 2026 analysis says it attributed all the incidents to a single actor and links infrastructure to the cluster known as Static Tundra, Berserk Bear or Ghost Blizzard. Treat the exact unit as contested; the defensive lessons are the same.

Detection and defence

What to monitor

Priority defences

1. Close the edge first: patch the KEV-listed products Microsoft names (CVE-2021-34473, CVE-2023-23397, CVE-2023-42793, CVE-2024-1709, CVE-2023-48788) and remove management interfaces from the internet. See the Edge Device Security Guide.
2. Require phishing-resistant MFA on VPN and remote access: Microsoft's BadPilot guidance recommends FIDO keys or passkeys and Network Level Authentication for RDP.
3. Lock down Tier 0: restrict who can create or link GPOs, alert on every GPO change and keep domain admin credentials off ordinary workstations.
4. Control remote management tools: allow-list approved RMM agents with application control (AppLocker or WDAC) and block the rest.
5. Segment IT from OT: in 2022 the wiper stayed in IT and did not reach the SCADA hypervisor. Keep it that way with separate identities and a monitored conduit. See the OT Security Guide.
6. Build for recovery: keep immutable or offline backups with separate credentials, and rehearse rebuilding Active Directory from a known-good state. Test by restoring a domain controller in an isolated network. See the Backup Security and Immutable Backup Guide.

Roll out new GPO and RMM controls in audit mode first, on a pilot OU, and keep a documented rollback (unlink the policy, restore the previous GPO backup) before enforcing domain-wide.

Metrics

• Edge exposure: days from KEV listing to patch for internet-facing systems (target: within the CISA due date).
• MFA coverage: percentage of VPN and remote access accounts using phishing-resistant MFA.
• Tier 0 change control: percentage of GPO changes matched to an approved change ticket.
• Unapproved RMM: count of hosts with remote management agents outside the allow-list.
• Recovery readiness: time to restore a domain controller and core services in the last test.

Decision guidance by organisation size

Smaller organisations should focus on three things: no exposed management interfaces, MFA on every remote access path and offline backups. Larger operators and critical infrastructure should add Tier 0 isolation, OT-specific monitoring of engineering tools and a rehearsed wiper scenario. If you have operations or suppliers in Ukraine, treat shared networks and software updates from those sites as untrusted until verified, the NotPetya lesson.

Framework mapping

Common failure patterns

• VPN without MFA: the Polish 2025 intrusions began at VPN interfaces that accepted password-only logins, the same weakness behind the Colonial Pipeline Ransomware Attack 2021.
• Unmonitored Group Policy: no alert when a new GPO creates scheduled tasks across the estate, so the first sign is wiped machines.
• Backups reachable with domain credentials: if the domain admin who pushes a wiper can also delete backups, recovery fails.
• End-of-life OT software with defaults left on: the 2022 MicroSCADA host was out of support with SCIL API access enabled.
• Trusting remote management tools by name: an Atera or Splashtop agent looks like IT, so nobody asks who installed it.

Practitioner checklist

• Inventory every internet-facing system and confirm the BadPilot CVEs are patched.
• Enforce phishing-resistant MFA on VPN, OWA and remote administration.
• Alert on GPO creation, linking and changes that add scheduled tasks or file copies.
• Limit GPO edit rights to a small Tier 0 group using dedicated admin workstations.
• Allow-list remote management agents and alert on new installations.
• Monitor LSASS access and NTDS.dit copies on domain controllers.
• Separate IT and OT identities; block IT domain accounts from SCADA hosts.
• Keep offline or immutable backups with separate credentials and test a full AD restore.
• Subscribe to CERT-UA, ESET, Microsoft and Mandiant reporting on Sandworm and map new techniques to your detections.

Standards and references

• MITRE ATT&CK: Sandworm Team (G0034)
• US Department of Justice: Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware
• Mandiant: APT44, Unearthing Sandworm
• Mandiant: Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology
• Microsoft: The BadPilot Campaign, Seashell Blizzard Subgroup Conducts Multiyear Global Access Operation
• ESET: Industroyer2, Industroyer Reloaded
• US Department of Justice: Court-Authorized Disruption of Botnet Controlled by the Russian GRU (Cyclops Blink)
• Help Net Security: Poland's Energy Control Systems Were Breached Through Exposed VPN Access

Related NHI Mgmt Group resources: Threat Actor Groups Guide · Wiper Malware Guide · OT Incident Response Guide · Tiered Administration and Enterprise Access Model Guide · Edge Device Security Guide