Watch Floor
State-backedRussiaMITRE G0034

Sandworm

Also known as Quedagh, VOODOO BEAR, TEMP.Noble, IRON VIKING, G0034, ELECTRUM, TeleBots, IRIDIUM, Blue Echidna, FROZENBARENTS, UAC-0113, Seashell Blizzard, UAC-0082, APT44, SANDWORM RELIC, UAC-0145, Sandworm Team, BlackEnergy (Group)

0mentions, 7 days
9mentions, 30 days
Oct 26, 2026last mentioned

This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes. Some believe that the threat actor is linked to the 2015 compromise of the Ukrainian electrical grid and a distributed denial of service prior to the Russian invasion of Georgia. Believed to be responsible for the 2008 DDoS attacks in Georgia and the 2015 Ukraine power grid outage

Targets: Private sector, Government, Russia, Lithuania, Kyrgyzstan, Israel, Ukraine, Belarus, Kazakhstan, Georgia, Poland, Azerbaijan, Iran

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T0819 Exploit Public-Facing ApplicationT0884 Connection ProxyT1003.001 LSASS MemoryT1003.003 NTDST1005 Data from Local SystemT1018 Remote System DiscoveryT1021.002 SMB/Windows Admin SharesT1027 Obfuscated Files or InformationT1027.010 Command ObfuscationT1033 System Owner/User DiscoveryT1036 MasqueradingT1036.005 Match Legitimate Resource Name or LocationT1040 Network SniffingT1041 Exfiltration Over C2 ChannelT1047 Windows Management InstrumentationT1049 System Network Connections DiscoveryT1053.005 Scheduled TaskT1056.001 KeyloggingT1059.001 PowerShellT1059.005 Visual BasicT1070.004 File DeletionT1071.001 Web ProtocolsT1072 Software Deployment ToolsT1078 Valid AccountsT1078.002 Domain AccountsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.002 Domain AccountT1087.003 Email AccountT1090 ProxyT1102.002 Bidirectional CommunicationT1105 Ingress Tool TransferT1106 Native APIT1132.001 Standard EncodingT1133 External Remote ServicesT1140 Deobfuscate/Decode Files or InformationT1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1195.002 Compromise Software Supply ChainT1199 Trusted RelationshipT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1213.006 DatabasesT1218.011 Rundll32T1219 Remote Access ToolsT1409 Stored Application DataT1485 Data DestructionT1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System RecoveryT1491.002 External DefacementT1499 Endpoint Denial of ServiceT1505.003 Web ShellT1539 Steal Web Session CookieT1555.003 Credentials from Web BrowsersT1561.002 Disk Structure WipeT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1570 Lateral Tool TransferT1571 Non-Standard PortT1583 Acquire InfrastructureT1583.001 DomainsT1583.004 ServerT1584.004 ServerT1584.005 BotnetT1585.001 Social Media AccountsT1585.002 Email AccountsT1586.001 Social Media AccountsT1587.001 MalwareT1588.002 ToolT1588.006 VulnerabilitiesT1589.002 Email AddressesT1589.003 Employee NamesT1590.001 Domain PropertiesT1591.002 Business RelationshipsT1592.002 SoftwareT1593 Search Open Websites/DomainsT1594 Search Victim-Owned WebsitesT1595.002 Vulnerability Scanning

Recent activity

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.