Sandworm Team has used webshells including

P.A.S. Webshell to maintain access to victim networks.(Citation: ANSSI Sandworm January 2021)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1589.002|Email Addresses|

Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1589.003|Employee Names|

Sandworm Team's research of potential victim organizations included the identification and collection of employee information.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1598.003|Spearphishing Link|

Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1592.002|Software|

Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017

NotPetya attack.

Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1593|Search Open Websites/Domains|

Sandworm Team researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the

NotPetya attack.