Sandworm Team used the credentials of valid accounts to interact with client applications and access employee workstations hosting HMI applications. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)(Citation: Dragos)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|None|T0884|Connection Proxy|

Sandworm Team establishes an internal proxy prior to the installation of backdoors within the network. (Citation: Dragos Inc. June 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Human-Machine Interface|T0819|Exploit Public-Facing Application|

Sandworm Team actors exploited vulnerabilities in GE's Cimplicity HMI and Advantech/Broadwin WebAccess HMI software which had been directly exposed to the internet. (Citation: ICS-CERT December 2014) (Citation: ICS CERT September 2018)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Field Controller/RTU/PLC/IED|T0855|Unauthorized Command Message|In the Ukraine 2015 Incident,

Sandworm Team issued unauthorized commands to substation breakers after gaining control of operator workstations and accessing a distribution management system (DMS) client application. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Safety Instrumented System/Protection Relay,Field Controller/RTU/PLC/IED,Input/Output Server|T0857|System Firmware|In the Ukraine 2015 Incident,

Sandworm Team developed and used malicious firmware to render communication devices inoperable. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Control Server,Input/Output Server|T0822|External Remote Services|In the Ukraine 2015 Incident,