[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6JIUba49ghHNLw7SlX-a-BGCUhiAzNujAcHJ-2RS1e8":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":23,"country":24,"suspected_sponsor":25,"target_industries":26,"target_countries":29,"incident_types":41,"references":43,"techniques":68,"technique_count":69,"created_at":70,"seoMetadata":71,"schemaOrg":75},"Sandworm","sandworm",[9,10,11,12,13,14,15,16,17,18,19,20,21,22],"Quedagh","VOODOO BEAR","TEMP.Noble","IRON VIKING","G0034","ELECTRUM","TeleBots","IRIDIUM","Blue Echidna","FROZENBARENTS","UAC-0113","Seashell Blizzard","UAC-0082","APT44","This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes. Some believe that the threat actor is linked to the 2015 compromise of the Ukrainian electrical grid and a distributed denial of service prior to the Russian invasion of Georgia. Believed to be responsible for the 2008 DDoS attacks in Georgia and the 2015 Ukraine power grid outage","RU","Russian Federation",[27,28],"Private sector","Government",[30,31,32,33,34,35,36,37,38,39,40],"Russia","Lithuania","Kyrgyzstan","Israel","Ukraine","Belarus","Kazakhstan","Georgia","Poland","Azerbaijan","Iran",[42],"Espionage",[44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67],"https:\u002F\u002Fdragos.com\u002Fblog\u002Fcrashoverride\u002FCrashOverride-01.pdf","https:\u002F\u002Fwww.us-cert.gov\u002Fncas\u002Falerts\u002FTA17-163A","https:\u002F\u002Fics.sans.org\u002Fblog\u002F2016\u002F01\u002F09\u002Fconfirmation-of-a-coordinated-attack-on-the-ukrainian-power-grid","https:\u002F\u002Fweb.archive.org\u002Fweb\u002F20141016132823\u002Fhttps:\u002F\u002Fwww.symantec.com\u002Fconnect\u002Fblogs\u002Fsandworm-windows-zero-day-vulnerability-being-actively-exploited-targeted-attacks","https:\u002F\u002Fics.sans.org\u002Fblog\u002F2015\u002F12\u002F30\u002Fcurrent-reporting-on-the-cyber-attack-in-ukraine-resulting-in-power-outage","https:\u002F\u002Fweb.archive.org\u002Fweb\u002F20141224060545\u002Fhttp:\u002F\u002Fblog.trendmicro.com\u002Ftrendlabs-security-intelligence\u002Ftimeline-of-sandworm-attacks\u002F","https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0034","https:\u002F\u002Fblog.google\u002Fthreat-analysis-group\u002Fcontinued-cyber-activity-in-eastern-europe-observed-by-tag","https:\u002F\u002Fwww.welivesecurity.com\u002Fwp-content\u002Fuploads\u002F2017\u002F06\u002FWin32_Industroyer.pdf","https:\u002F\u002Fdragos.com\u002Fmedia\u002F2017-Review-Industrial-Control-System-Threats.pdf","https:\u002F\u002Fdragos.com\u002Fadversaries.html","http:\u002F\u002Fwww.welivesecurity.com\u002F2016\u002F12\u002F13\u002Frise-telebots-analyzing-disruptive-killdisk-attacks","https:\u002F\u002Fwww.welivesecurity.com\u002F2017\u002F01\u002F05\u002Fkilldisk-now-targeting-linux-demands-250k-ransom-cant-decrypt","https:\u002F\u002Fwww.welivesecurity.com\u002F2017\u002F06\u002F30\u002Ftelebots-back-supply-chain-attacks-against-ukraine","https:\u002F\u002Fwww.welivesecurity.com\u002F2017\u002F05\u002F23\u002Fxdata-ransomware-making-rounds-amid-global-wannacryptor-scare","https:\u002F\u002Fwww.welivesecurity.com\u002F2017\u002F06\u002F27\u002Fnew-ransomware-attack-hits-ukraine","https:\u002F\u002Fwww.welivesecurity.com\u002F2017\u002F10\u002F24\u002Fbad-rabbit-not-petya-back","https:\u002F\u002Fblog.google\u002Fthreat-analysis-group\u002Ffog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape\u002F","https:\u002F\u002Fwww.recordedfuture.com\u002Frussia-nexus-uac-0113-emulating-telecommunication-providers-in-ukraine","https:\u002F\u002Fcert.gov.ua\u002Farticle\u002F405538","https:\u002F\u002Fcip.gov.ua\u002Fservices\u002Fcm\u002Fapi\u002Fattachment\u002Fdownload?id=60068","https:\u002F\u002Fpacketstormsecurity.com\u002Fnews\u002Fview\u002F35790\u002FRecent-OT-And-Espionage-Attacks-Linked-To-Russias-Sandworm-Now-Named-APT44.html","https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Fapt44-unearthing-sandworm?linkId=9627235","https:\u002F\u002Fservices.google.com\u002Ffh\u002Ffiles\u002Fmisc\u002Fapt44-unearthing-sandworm.pdf",[],0,"2023-08-09T17:25:09.409843+00:00",{"title":72,"metaDescription":73,"keywords":74},"Sandworm Threat Actor Profile | Precursor Intelligence","This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage...","Sandworm, Quedagh, VOODOO BEAR, TEMP.Noble, IRON VIKING, G0034, ELECTRUM, TeleBots, IRIDIUM, Blue Echidna, FROZENBARENTS, UAC-0113, Seashell Blizzard, UAC-0082, APT44, threat actor, APT, cyber threat, threat intelligence, Private sector, Government, Russian Federation, RU",{"@context":76,"@type":77,"name":6,"alternateName":78,"description":23,"url":79,"mainEntityOfPage":80,"location":82},"https:\u002F\u002Fschema.org","Organization",[9,10,11,12,13,14,15,16,17,18,19,20,21,22],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fsandworm",{"@type":81,"@id":79},"WebPage",{"@type":83,"name":24},"Country"]