UFO-1

Scenario

Being in the ICS Industry, your security team always needs to be up to date and should be aware of the threats targeting organizations in your industry. You just started as a Threat intelligence intern, with a bit of SOC experience. Your manager has given you a task to test your skills in research and how well can you utilize Mitre Att&ck to your advantage.

Do your research on Sandworm Team, also known as BlackEnergy Group and APT44. Utilize Mitre ATT&CK to understand how to map adversary behavior and tactics in actionable form.

Smash the assessment and impress your manager as Threat intelligence is your passion.

Executive Summary

Sandworm Team (G0034), a GRU-linked group also tracked as BlackEnergy Group and APT44, has been active for well over a decade. In the 2016 campaign against the Ukrainian power grid it brute-forced credentials to reach hosts on the compromised network and ran a VBScript helper from a staging directory. In 2022 it returned to a power-sector target, kept remote access through a web shell on a server application, and abused a native MicroSCADA binary to send commands to substations before running a wiper against the environment. Elsewhere in its history the group is tied to a self-spreading wiper disguised as ransomware that rode a Windows SMB flaw worldwide, a tool aimed at satellite modems, an SSH listener on a non-standard port, and a collaboration with a second GRU-linked group. Everything here comes from MITRE ATT&CK pages for the group, the two campaigns and the individual tools.

Artifacts

• None: this is an OSINT-only case with no evidence files. Every answer comes from MITRE ATT&CK: the Sandworm Team group page (G0034), the 2016 and 2022 campaign pages (C0025, C0034), and the software page for CaddyWiper (S0693)

Note: The campaign IDs C0025 and C0034 are MITRE’s own. Question 2 and 3 live on the 2016 campaign page, and Questions 4 to 8 on the 2022 one. Several questions say “the same campaign”, so read them against C0034.

Threat Actor Profile

The group page carries no start year in its prose. The date sits in the footnotes: the FireEye citation attached to the group description states that the group has been active since at least 2009. The question asks for what MITRE’s cited sources say, so the footnote is the answer, not any later campaign date.

Source: https://attack.mitre.org/groups/G0034/

The group page names GRU Unit 26165 as the collaborating unit. MITRE tracks that unit as APT28, so the group name follows from the unit number given on the Sandworm page.

Source: https://attack.mitre.org/groups/G0034/

Credential Access

On the 2016 campaign page, the credential access entries are LSASS Memory (T1003.001) and a second technique for obtaining valid logins over RPC. The group guessed passwords against hosts in the compromised network, which is Brute Force. The same technique appears on the group page. The mask T**** takes the parent technique with no sub-technique.

Source: https://attack.mitre.org/groups/G0034/

Execution

The 2016 campaign page shows the group running a VBScript with cscript from a C:\Backinfo\ directory. The filename is the last path component of that command.

Source: https://attack.mitre.org/groups/G0034/

The 2022 campaign page describes the group abusing a legitimate MicroSCADA component rather than bringing its own tooling for the SCADA step. The binary is the MicroSCADA command-line interpreter, a native executable already on the SCADA host.

Source: https://attack.mitre.org/groups/G0034/

From Q6, find where the same campaign page shows scilc.exe being run. The command line points at the prog\exec directory under the MicroSCADA install root and passes a script file from pack\scil. Copy it exactly as MITRE prints it, with the -do switch and the script path.

Source: https://attack.mitre.org/groups/G0034/

Gotcha: The mask C:\**\****\****\*****.*** -** ****\****\**.*** fixes the directory depth and the lengths of each segment. Count characters against it before settling on the path.

From Q8, open the CaddyWiper software page. Its technique table lists a single Execution entry, Native API, which is the wiper calling Windows APIs directly (for example to enumerate and overwrite files and partitions).

Source: https://attack.mitre.org/software/S0693/

Persistence

The 2022 campaign page lists a web shell on a server application as the way the group kept remote access. The technique is Server Software Component: Web Shell, and the mask T****.*** asks for the sub-technique form.

Source: https://attack.mitre.org/groups/G0034/

From Q4, the same 2022 campaign entry names the web shell. It is a hyphenated name that matches the ***-******* mask, a tunnelling web shell derived from reGeorg.

Source: https://attack.mitre.org/groups/G0034/

Impact

The 2022 campaign page lists a wiper used for data destruction against the compromised environment. The ten-letter mask fits the name.

Source: https://attack.mitre.org/groups/G0034/

The group page’s software list includes the self-propagating wiper that posed as ransomware in 2017. The eight-letter mask matches its name.

Source: https://attack.mitre.org/groups/G0034/

From Q10, NotPetya spread through the SMB flaw known as EternalBlue (CVE-2017-0144, which is also in this case’s tags). The bulletin ID is reference knowledge rather than something read from a MITRE page: Microsoft’s March 2017 bulletin for that SMBv1 flaw was MS17-010. This one was reasoned from that mapping and then accepted by the platform.

The group page lists a wiper aimed at modems and routers. The eight-letter mask fits it.

Source: https://attack.mitre.org/groups/G0034/

Command and Control

The group page describes the group setting up an SSH server on a non-standard port for listening. The port number is stated in that entry.

Source: https://attack.mitre.org/groups/G0034/

Attack Summary

IOCs

MITRE ATT&CK

Defender Takeaways

Treat a SCADA host’s own binaries as an attack surface. In 2022 the group used scilc.exe, a legitimate MicroSCADA component, to act on substations. Allow-listing that only checks for unknown executables misses this. Alert on scilc.exe launches with -do and a script argument, especially from a non-operator account or outside maintenance windows.

Internet-facing server software is a persistence path into OT. The Neo-reGeorg web shell kept remote access through a server application. Monitor web roots for new or modified scripts, and look for long-lived HTTP tunnelling traffic from servers that sit between IT and the SCADA network.

Password guessing against internal hosts still works. The 2016 campaign relied on brute force and LSASS access to move across hosts. Lockout thresholds, alerts on bursts of failed RPC authentication, and Credential Guard cover both steps.

Patch the SMB flaw behind NotPetya, and retire SMBv1. MS17-010 turned one wiper into a global outage. Segment SMB between IT and OT, and disable SMBv1 where nothing needs it.

Plan recovery for wipers, not just ransomware. NotPetya, CaddyWiper and AcidRain are all destructive, and paying a ransom is not an option for any of them. Offline backups and tested rebuild procedures for engineering workstations and network gear are the control that matters.

Conclusion

Sandworm Team’s record runs from brute-forced credentials in 2016 to a web shell, a native SCADA binary and a wiper in 2022, with a worldwide worm and a modem wiper along the way. Mapping those steps to ATT&CK turns a news-cycle history into a concrete detection list for any ICS defender.