If Sandworm wiped your servers, what would you restore first?
A destructive threat group attributed to Russia’s military intelligence (GRU unit 74455), active since at least 2009, behind attacks on Ukraine’s power grid and NotPetya.
Sandworm Team
- Origin
- Russia · State-sponsored
- Also known as
- Voodoo Bear, Seashell Blizzard
- Lure
- Supply chain How they get in
- Weapon
- Wipers Their signature move
- Loot
- Outage What they are after
- MITRE ATT&CK®
- Sandworm Team (G0034)
Try an exercise against this group
In an exercise against a group like this one, your team meets techniques like those documented for it, in the order a real attack would take. Afterwards the report shows where the attack was stopped.
Book a demo See all threat cards
The cards describe publicly known threat groups. They say nothing about who those groups target. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK® is a registered trademark of The MITRE Corporation.