2016 Ukraine Electric Power Attack
2016 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used Industroyer malware to target and disrupt distribution substations within the Ukrainian power grid. This campaign was the second major public attack conducted against Ukraine by Sandworm Team.[1][2]
Groups
| ID | Name | Description |
|---|---|---|
| G0034 | Sandworm Team |
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1047 | Windows管理规范 |
During the 2016 Ukraine Electric Power Attack, WMI in scripts were used for remote execution and system surveys. [2] |
|
| Enterprise | T1554 | 主机软件二进制文件妥协 |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.[1] |
|
| Enterprise | T1036 | .005 | 伪装: Match Legitimate Name or Location |
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.[5] |
| .008 | 伪装: Masquerade File Type |
During the 2016 Ukraine Electric Power Attack, Sandworm Team masqueraded executables as |
||
| .010 | 伪装: Masquerade Account Name |
During the 2016 Ukraine Electric Power Attack, Sandworm Team created two new accounts, "admin" and "система" (System).[2] |
||
| Enterprise | T1543 | .003 | 创建或修改系统进程: Windows Service |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary. [5] |
| Enterprise | T1136 | 创建账户 |
During the 2016 Ukraine Electric Power Attack, Sandworm Team added a login to a SQL Server with |
|
| .002 | Domain Account |
During the 2016 Ukraine Electric Power Attack, Sandworm Team created two new accounts, "admin" and "система" (System). The accounts were then assigned to a domain matching local operation and were delegated new privileges.[2] |
||
| Enterprise | T1059 | .001 | 命令与脚本解释器: PowerShell |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.[2] |
| .003 | 命令与脚本解释器: Windows Command Shell |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the |
||
| .005 | 命令与脚本解释器: Visual Basic |
During the 2016 Ukraine Electric Power Attack, Sandworm Team created VBScripts to run on an SSH server.[2] |
||
| Enterprise | T1562 | .002 | 妨碍防御: Disable Windows Event Logging |
During the 2016 Ukraine Electric Power Attack, Sandworm Team disabled event logging on compromised systems.[2] |
| Enterprise | T1003 | .001 | 操作系统凭证转储: LSASS Memory |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used Mimikatz to capture and use legitimate credentials.[2] |
| Enterprise | T1110 | 暴力破解 |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used a script to attempt RPC authentication against a number of hosts.[2] |
|
| Enterprise | T1505 | .001 | 服务器软件组件: SQL Stored Procedures |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used various MS-SQL stored procedures.[2] |
| Enterprise | T1570 | 横向工具传输 |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used |
|
| Enterprise | T1027 | 混淆文件或信息 |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used heavily obfuscated code with Industroyer in its Windows Notepad backdoor.[1] |
|
| .002 | Software Packing |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used UPX to pack a copy of Mimikatz.[2] |
||
| Enterprise | T1098 | 账号操控 |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the |
|
| Enterprise | T1021 | .002 | 远程服务: SMB/Windows Admin Shares |
During the 2016 Ukraine Electric Power Attack, Sandworm Team utilized |
| Enterprise | T1018 | 远程系统发现 |
During the 2016 Ukraine Electric Power Attack, Sandworm Team checked for connectivity to resources within the network and used LDAP to query Active Directory, discovering information about computers listed in AD.[2] |
|
| ICS | T0807 | Command-Line Interface |
During the 2016 Ukraine Electric Power Attack, Sandworm Team supplied the name of the payload DLL to Industroyer via a command line parameter.[1] |
|
| ICS | T0867 | Lateral Tool Transfer |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used a VBS script to facilitate lateral tool transfer. The VBS script was used to copy ICS-specific payloads with the following command: |
|
| ICS | T0849 | Masquerading |
During the 2016 Ukraine Electric Power Attack, Sandworm Team transferred executable files as .txt and then renamed them to .exe, likely to avoid detection through extension tracking.[2] |
|
| ICS | T0886 | Remote Services |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used MS-SQL access to a pivot machine, allowing code execution throughout the ICS network.[2] |
|
| ICS | T0853 | Scripting |
During the 2016 Ukraine Electric Power Attack, Sandworm Team utilized VBS and batch scripts for file movement and as wrappers for PowerShell execution.[2] |
|
| ICS | T0859 | Valid Accounts |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used valid accounts to laterally move through VPN connections and dual-homed systems.[2] |
|
Software
| ID | Name | Description |
|---|---|---|
| S0604 | Industroyer |
Within the 2016 Ukraine Electric Power Attack, Industroyer was used to target and disrupt the Ukrainian power grid substation components.[2][1] |
References
- Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.
- Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.
- Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.