2016 Ukraine Electric Power Attack

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. 2016 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used Industroyer malware to target and disrupt distribution substations within the Ukrainian power grid. This campaign was the second major public attack conducted against Ukraine by Sandworm Team.(Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)

This is a historical record and does not establish current campaign activity.

Threat actor

Sandworm Team

Attribution confidence

Not established

First documented activity

2016-12-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2016-12-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2016-12-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1059.005 · Visual Basic

  Execution — During the 2016 Ukraine Electric Power Attack, Sandworm Team created VBScripts to run on an SSH server.(Citation: Dragos Crashoverride 2018)

• T1036.008 · Masquerade File Type

  Stealth — During the 2016 Ukraine Electric Power Attack, Sandworm Team masqueraded executables as `.txt` files.(Citation: Dragos Crashoverride 2018)

• T1059.001 · PowerShell

  Execution — During the 2016 Ukraine Electric Power Attack, Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.(Citation: Dragos Crashoverride 2018)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.(Citation: Dragos Crashoverride 2017)

• T1505.001 · SQL Stored Procedures

  Persistence — During the 2016 Ukraine Electric Power Attack, Sandworm Team used various MS-SQL stored procedures.(Citation: Dragos Crashoverride 2018)

• T1136 · Create Account

  Persistence — During the 2016 Ukraine Electric Power Attack, Sandworm Team added a login to a SQL Server with `sp_addlinkedsrvlogin`.(Citation: Dragos Crashoverride 2018)

• T1685.001 · Disable or Modify Windows Event Log

  Defense Impairment — During the 2016 Ukraine Electric Power Attack, Sandworm Team disabled event logging on compromised systems.(Citation: Dragos Crashoverride 2018)

• T1570 · Lateral Tool Transfer

  Lateral Movement — During the 2016 Ukraine Electric Power Attack, Sandworm Team used `move` to transfer files to a network share.(Citation: Dragos Crashoverride 2018)

• T1059.003 · Windows Command Shell

  Execution — During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `xp_cmdshell` command in MS-SQL.(Citation: Dragos Crashoverride 2018)

• T1027 · Obfuscated Files or Information

  Stealth — During the 2016 Ukraine Electric Power Attack, Sandworm Team used heavily obfuscated code with Industroyer in its Windows Notepad backdoor.(Citation: ESET Industroyer)

• T1543.003 · Windows Service

  Persistence, Privilege Escalation — During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary. (Citation: Dragos Crashoverride 2017)

• T1027.002 · Software Packing

  Stealth — During the 2016 Ukraine Electric Power Attack, Sandworm Team used UPX to pack a copy of Mimikatz.(Citation: Dragos Crashoverride 2018)

• T1036.010 · Masquerade Account Name

  Stealth — During the 2016 Ukraine Electric Power Attack, Sandworm Team created two new accounts, “admin” and “система” (System).(Citation: Dragos Crashoverride 2018)

• T1003.001 · LSASS Memory

  Credential Access — During the 2016 Ukraine Electric Power Attack, Sandworm Team used Mimikatz to capture and use legitimate credentials.(Citation: Dragos Crashoverride 2018)

• T1047 · Windows Management Instrumentation

  Execution — During the 2016 Ukraine Electric Power Attack, WMI in scripts were used for remote execution and system surveys. (Citation: Dragos Crashoverride 2018)

• T1098 · Account Manipulation

  Persistence, Privilege Escalation — During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `sp_addlinkedsrvlogin` command in MS-SQL to create a link between a created account and other servers in the network.(Citation: Dragos Crashoverride 2018)

• T1110 · Brute Force

  Credential Access — During the 2016 Ukraine Electric Power Attack, Sandworm Team used a script to attempt RPC authentication against a number of hosts.(Citation: Dragos Crashoverride 2018)

• T1136.002 · Domain Account

  Persistence — During the 2016 Ukraine Electric Power Attack, Sandworm Team created two new accounts, “admin” and “система” (System). The accounts were then assigned to a domain matching local operation and were delegated new privileges.(Citation: Dragos Crashoverride 2018)

• T1018 · Remote System Discovery

  Discovery — During the 2016 Ukraine Electric Power Attack, Sandworm Team checked for connectivity to resources within the network and used LDAP to query Active Directory, discovering information about computers listed in AD.(Citation: Dragos Crashoverride 2018)

• T1554 · Compromise Host Software Binary

  Persistence — During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.(Citation: ESET Industroyer)

• T1021.002 · SMB/Windows Admin Shares

  Lateral Movement — During the 2016 Ukraine Electric Power Attack, Sandworm Team utilized `net use` to connect to network shares.(Citation: Dragos Crashoverride 2018)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0025

  Official MITRE ATT&CK campaign record C0025. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.