Sandworm Team has used intercepter-NG to sniff passwords in network traffic.(Citation: ESET Telebots Dec 2016)    |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1087.002|Domain Account|

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.(Citation: ESET Telebots Dec 2016)  |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

Sandworm Team has sent system information to its C2 server using HTTP.(Citation: ESET Telebots Dec 2016)   |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots July 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Sandworm Team has used backdoors that can delete files used in an attack from an infected system.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots July 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.(Citation: ESET Telebots Dec 2016)  |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1090|Proxy|