Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1588.006|Vulnerabilities|In 2017,

Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1588.002|Tool|

Sandworm Team has acquired open-source tools for their operations, including

Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to

Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as

Impacket and RemoteExec, which were used in their 2022

Prestige operations.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1059.001|PowerShell|

Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Dragos Crashoverride 2018) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Dragos Crashoverride 2018) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|