Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as

NotPetya and

Olympic Destroyer.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.(Citation: ESET Telebots Dec 2016)(Citation: Dragos Crashoverride 2018) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Office 365,Google Workspace|T1087.003|Email Account|

Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.(Citation: ESET Telebots July 2017)   |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Sandworm Team used a backdoor to enumerate information about the infected system's operating system.(Citation: ESET Telebots July 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)   |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1218.011|Rundll32|

Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.(Citation: ESET Telebots July 2017)    |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1195.002|Compromise Software Supply Chain|

Sandworm Team has distributed