Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor.

Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.(Citation: ESET Telebots Dec 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1003.001|LSASS Memory|

Sandworm Team has used its plainpwd tool, a modified version of

Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)(Citation: Microsoft Prestige ransomware October 2022)    |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.(Citation: ESET Telebots Dec 2016)   |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network,IaaS|T1040|Network Sniffing|