Sandworm Team harvested VPN worker credentials and used them to remotely log into control system networks. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016) (Citation: Zetter, Kim March 2016) (Citation: ICS-CERT February 2016) (Citation: John Hultquist January 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Field Controller/RTU/PLC/IED|T0816|Device Restart/Shutdown|In the 2015 attack on the Ukrainian power grid, the

Sandworm Team scheduled disconnects of uninterruptable power supply (UPS) systems so that when power was disconnected from the substations, the devices would shut down and service could not be recovered. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Engineering Workstation,Human-Machine Interface,Control Server,Data Historian|T0865|Spearphishing Attachment|In the Ukraine 2015 incident,

Sandworm Team sent spearphishing attachments to three energy distribution companies containing malware to gain access to victim systems. (Citation: UNITED STATES DISTRICT COURT WESTERN DISTRICT OF PENNSYLVANIA October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Field Controller/RTU/PLC/IED,Input/Output Server,Device Configuration/Parameters|T0804|Block Reporting Message|In the Ukraine 2015 Incident,

Sandworm Team blocked reporting messages by using malicious firmware to render communication devices inoperable. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Field Controller/RTU/PLC/IED,Device Configuration/Parameters|T0803|Block Command Message|In the Ukraine 2015 Incident,