Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.(Citation: ESET Telebots Dec 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1003.003|NTDS|

Sandworm Team has used

Sandworm Team has used

Prestige ransomware to encrypt data at targeted organizations in transportation and related logistics industries in Ukraine and Poland.(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1584.005|Botnet|

Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.(Citation: NCSC Cyclops Blink February 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1047|Windows Management Instrumentation|

Sandworm Team has used

Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.(Citation: Dragos Crashoverride 2018)(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Sandworm Team has copied payloads to the

Sandworm Team has used

Prestige ransomware--to an Active Directory Domain Controller and distributed via the Default Domain Group Policy Object.(Citation: Dragos Crashoverride 2018)(Citation: Microsoft Prestige ransomware October 2022) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,macOS,Linux|T1136.002|Domain Account|

Sandworm Team has created new domain accounts on an ICS access server.(Citation: Dragos Crashoverride 2018)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Sandworm Team has used webshells including