Sandworm Team have used previously acquired legitimate credentials prior to attacks.(Citation: US-CERT Ukraine Feb 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1561.002|Disk Structure Wipe|

Sandworm Team has used the

BlackEnergy KillDisk component to corrupt the infected system's master boot record.(Citation: US-CERT Ukraine Feb 2016)(Citation: ESET Telebots June 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,IaaS,Linux,macOS|T1485|Data Destruction|

Sandworm Team has used the

BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces. (Citation: US-CERT Ukraine Feb 2016)(Citation: ESET Telebots June 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Sandworm Team has avoided detection by naming a malicious binary explorer.exe.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor.