APT groupMITRE G0034

Sandworm Team

Also known as: apt44, blackenergy (group), blue echidna, electrum, frozenbarents, g0034, iridium, iron viking, quedagh, sandworm, sandworm relic, seashell blizzard

Profile

Sandworm Team is a threat group known for destructive operations against critical infrastructure, particularly in the energy sector. Its documented activity dates back at least to December 2015, when an attack on Ukraine's power grid caused a blackout affecting roughly 230,000 people. According to ESET, in late 2025 the group was behind a cyberattack on Poland's power grid using DynoWiper, malware designed to erase data. What sets the group apart is its use of wiper malware for sabotage rather than financial gain, together with an apparent symbolic use of timing: the Poland attack fell on the tenth anniversary of the Ukrainian incident. BlackEnergy is also among the tools associated with the group's campaigns against the electricity sector.

Active since: 2015

Tools

DynoWiper (wiper), BlackEnergy

What defenders should watch

Pay particular attention to operational technology (OT/ICS) environments in the energy sector, the group's recurring documented target in Ukraine and Poland.
Prepare detection and response for wiper malware such as DynoWiper: keep offline, verified backups and test restoration procedures, since the goal is data destruction rather than extortion.
Review historical indicators associated with BlackEnergy in power-grid networks and segment industrial environments from the corporate network to limit spread.
Increase monitoring and response readiness around significant dates or anniversaries of earlier incidents, as the Poland campaign coincided with the tenth anniversary of the 2015 Ukraine attack.
Available sources do not specify the initial access vector used; maintain broad baseline controls (remote access, credentials, third-party suppliers) until more specific information is available.

Victims in the last 90 days0

Most affected countries

No data yet.

Most affected sectors

No data yet.

Priority mitigations

MITRE ATT&CK mitigations that cover the most techniques used by this group.

User Account Management (17 techniques covered)
User Training (15 techniques covered)
Network Intrusion Prevention (11 techniques covered)
Privileged Account Management (10 techniques covered)
Execution Prevention (9 techniques covered)
Behavior Prevention on Endpoint (9 techniques covered)
Restrict Web-Based Content (8 techniques covered)
Multi-factor Authentication (8 techniques covered)

MITRE ATT&CK techniques

T1608.001 · Upload Malware T1588.006 · Vulnerabilities T1040 · Network Sniffing T1027.010 · Command Obfuscation T1595.002 · Vulnerability Scanning T1585.001 · Social Media Accounts T1586.001 · Social Media Accounts T1132.001 · Standard Encoding T1213.006 · Databases T1539 · Steal Web Session Cookie T1059.001 · PowerShell T1090 · Proxy T1203 · Exploitation for Client Execution T1041 · Exfiltration Over C2 Channel T1053.005 · Scheduled Task T1190 · Exploit Public-Facing Application T1078.002 · Domain Accounts T1003.003 · NTDS T1036 · Masquerading T1598.003 · Spearphishing Link T1133 · External Remote Services T1587.001 · Malware T1072 · Software Deployment Tools T1584.005 · Botnet T1566.002 · Spearphishing Link T1018 · Remote System Discovery T1589.003 · Employee Names T1078 · Valid Accounts T1566.001 · Spearphishing Attachment T1204.002 · Malicious File T1106 · Native API T1588.002 · Tool T1583.004 · Server T1590.001 · Domain Properties T1083 · File and Directory Discovery T1049 · System Network Connections Discovery T1555.003 · Credentials from Web Browsers T1489 · Service Stop T1571 · Non-Standard Port T1070.004 · File Deletion T1047 · Windows Management Instrumentation T1021.002 · SMB/Windows Admin Shares T1204.001 · Malicious Link T1505.003 · Web Shell T1218.011 · Rundll32 T1499 · Endpoint Denial of Service T1195.002 · Compromise Software Supply Chain T1199 · Trusted Relationship T1056.001 · Keylogging T1561.002 · Disk Structure Wipe T1486 · Data Encrypted for Impact T1592.002 · Software T1491.002 · External Defacement T1583 · Acquire Infrastructure T1219 · Remote Access Tools T1584.004 · Server T1003.001 · LSASS Memory T1594 · Search Victim-Owned Websites T1570 · Lateral Tool Transfer T1027 · Obfuscated Files or Information

Recent victims

No data yet.

Sources analysed

ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025 (ESET WeLiveSecurity, 1/23/2026)

Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.

Sources: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.