Actors/Nation-state / APT/Europe

APT44

G0034APTRU · Russia

AKA Sandworm Team · Hades · UAC-0113 · BlackEnergy Group · ELECTRUM · Quedagh · Telebots · FROZENBARENTS · Seashell Blizzard · BE2 APT · Sandworm · GreyEnergy

Microsoft: IRIDIUMCrowdStrike: VOODOO BEARMITRE: G0034Secureworks: IRON VIKING

GRU Unit 74455 destructive-attack and disinformation group.

Targets25

Sectors17

Threat types2

GIRs covered0/480

Active since2009

Also tracked as

5 vendor names · 12 other aliases

Open Rosetta Stone

CrowdStrike

VOODOO BEAR

Mandiant

APT44

Microsoft

IRIDIUM

MITRE

G0034

Secureworks

IRON VIKING

UNATTRIBUTED ALIASESSandworm TeamHadesUAC-0113BlackEnergy GroupELECTRUMQuedaghTelebotsFROZENBARENTSSeashell BlizzardBE2 APTSandwormGreyEnergy

Victimology

Geographic footprint · 25 countries

origin · Russiatargeted countries · 25

AFRICA · 1

Angola

EUROPE · 14

Austria · Bulgaria · Switzerland · Germany · Spain · France · United Kingdom · Italy · Netherlands · Norway · Poland · Russia · Slovakia · Ukraine

OCEANIA · 2

Australia · New Zealand

AMERICAS · 3

Canada · Colombia · United States

ASIA · 5

Georgia · Iran · South Korea · Kazakhstan · Türkiye

Sectors targeted

17 of 40

Government100 actors Aviation22 actors Financial Services74 actors Cryptocurrency21 actors Healthcare47 actors Telecom72 actors Retail & Hospitality33 actors NGOs & Dissidents56 actors Energy / Utilities59 actors Oil and Gas21 actors Education & Research62 actors Manufacturing (man)50 actors Media & Journalism49 actors Real Estate10 actors Hospitality33 actors Consulting / Professional Services35 actors Consumer Goods / Electronics20 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

DIS · DisinformationESP · Espionage

MITRE ATT&CK · 55 techniques

Reconnaissance · 6

T1589.002Email Addresses T1589.003Employee Names T1590.001Domain Properties T1592.002Software T1593Search Open Websites/Domains T1594Search Victim-Owned Websites

Resource Development · 2

T1583Acquire Infrastructure T1583.004Server

Initial Access · 6

T1190Exploit Public-Facing Application

Execution · 8

T1047Windows Management Instrumentation

Credential Access · 4

T1003.001LSASS Memory

Discovery · 4

T1018Remote System Discovery

Lateral Movement · 2

T1021.002SMB/Windows Admin Shares

Collection · 1

T1005Data from Local System

Exfiltration · 1

T1041Exfiltration Over C2 Channel

Impact · 6

T1485Data Destruction

Command And Control · 6

T1071.001Web Protocols T1090Proxy

Stealth · 9

T1027Obfuscated Files or Information

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer55 techniques · layer format 4.5

Related actors

By origin and actor type

T1195

Supply Chain Compromise

T1195.002Compromise Software Supply Chain

T1199Trusted Relationship

T1566.001Spearphishing Attachment

T1566.002Spearphishing Link

T1053.005

Scheduled Task

T1059.001PowerShell

T1059.005Visual Basic

T1072Software Deployment Tools

T1106Native API

T1203Exploitation for Client Execution

T1204.001Malicious Link

T1003.003

NTDS

T1040Network Sniffing

T1555.003Credentials from Web Browsers

T1033

System Owner/User Discovery

T1049System Network Connections Discovery

T1083File and Directory Discovery

T1570

Lateral Tool Transfer

T1486

Data Encrypted for Impact

T1489Service Stop

T1490Inhibit System Recovery

T1499Endpoint Denial of Service

T1561.002Disk Structure Wipe

T1102.002

Bidirectional Communication

T1105Ingress Tool Transfer

T1219Remote Access Tools

T1571Non-Standard Port

T1027.010

Command Obfuscation

T1036Masquerading

T1036.005Match Legitimate Resource Name or Location

T1070.004File Deletion

T1078Valid Accounts

T1078.002Domain Accounts

T1140Deobfuscate/Decode Files or Information

T1218.011Rundll32