Sandworm Team has distributed

NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.(Citation: Secureworks NotPetya June 2017)(Citation: ESET Telebots June 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

Sandworm Team has used port 6789 to accept connections on the group's SSH server.(Citation: ESET BlackEnergy Jan 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,Windows,macOS|T1219|Remote Access Software|

Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.(Citation: US-CERT Ukraine Feb 2016)(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network.

Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.(Citation: ESET BlackEnergy Jan 2016)(Citation: ESET Telebots June 2017)(Citation: ANSSI Sandworm January 2021)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Sandworm Team has created VBScripts to run an SSH server.(Citation: ESET BlackEnergy Jan 2016)(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)(Citation: Dragos Crashoverride 2018) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|