Objective

Sherlock Scenario

The scenario places the analyst in an ICS-focused security team and asks for research into Sandworm Team, also known as BlackEnergy Group and APT44. The goal is to use MITRE ATT&CK to identify and map adversary behavior, techniques, malware, and infrastructure associated with the group.

This investigation focuses primarily on Sandworm activity tied to the 2016 Ukrainian electric power grid campaign, a 2022 campaign targeting Ukrainian infrastructure, and other tools historically associated with the group.

Sandworm Attribution and Campaign Research

Task 1: When did Sandworm Team begin operations?

I opened the MITRE ATT&CK page for Sandworm Team and reviewed the group summary. The page identifies when the group was first known to have begun operating.

Answer:

Task 2: What additional Credential Access technique was used during the 2016 campaign?

I opened the MITRE ATT&CK campaign page for the 2016 Ukraine Electric Power Attack (C0025) and reviewed the techniques associated with the campaign.

MITRE ATT&CK 2016 Ukraine Electric Power Attack campaign page

Using MITRE ATT&CK Navigator, I filtered the campaign techniques to the Credential Access tactic. Alongside LSASS Memory (T1003.001), the other listed technique was Brute Force.

ATT&CK Navigator showing Credential Access techniques

Answer:

T1110 — Brute Force

Task 3: What VBS script was used during the 2016 campaign?

I returned to the campaign page and searched the technique descriptions for references to .vbs files. The campaign documentation identified the script by name.

MITRE ATT&CK campaign description referencing ufn.vbs

Answer:

ufn.vbs

2022 Campaign and ICS Activity

Task 4: What persistence technique was used to maintain remote access?

I returned to the Sandworm group page and located the relevant 2022 campaign.

Sandworm MITRE ATT&CK page showing the 2022 campaign

I then opened the campaign in ATT&CK Navigator and reviewed the techniques under the Persistence tactic.

ATT&CK Navigator showing persistence techniques for the campaign

Because several persistence techniques were listed, I returned to the campaign page and reviewed the descriptions for each technique. The technique describing a server-side component used for continued remote access was Server Software Component: Web Shell.

MITRE ATT&CK web shell technique description

Answer:

T1505.003 — Web Shell

Task 5: What tool was used for the web-shell persistence?

The technique description identified the web shell used by the group.

Answer:

Neo-REGEORG

Task 6: Which SCADA application binary was abused for code execution?

I searched the campaign documentation for references to SCADA. Multiple technique descriptions referenced the same binary being used to execute commands in the SCADA environment.

MITRE ATT&CK procedure example referencing scilc.exe

Answer:

scilc.exe

Task 7: What command line was used against substations?

The command line was included in the ATT&CK description documenting how scilc.exe was used.

Answer:

C:\sc\prog\exec\scilc.exe -do pack\scil\s1.txt

Task 8: What malware was used for data destruction?

I reviewed the ATT&CK entry for the Data Destruction technique associated with the campaign. The description identified the destructive malware used.

MITRE ATT&CK data destruction procedure example for CaddyWiper

Answer:

CaddyWiper

Task 9: What Execution technique could CaddyWiper perform?

I opened the MITRE ATT&CK software page for CaddyWiper and reviewed its associated techniques. The relevant technique under Execution was Native API.

MITRE ATT&CK CaddyWiper techniques showing Native API

Answer:

T1106 — Native API

Associated Malware and Infrastructure

Task 10: What auto-spreading ransomware-like malware is associated with Sandworm?

I reviewed the software associated with Sandworm and identified the malware matching the description of an auto-spreading ransomware with worm-like behavior.

MITRE ATT&CK Sandworm software entry for NotPetya

Answer:

NotPetya

Task 11: What Microsoft security bulletin was associated with NotPetya's spread?

I opened the MITRE ATT&CK page for NotPetya and reviewed the documented techniques and exploitation behavior.

MITRE ATT&CK NotPetya procedure referencing MS17-010

Answer:

MS17-010

Task 12: What malware did Sandworm use to target modems?

I searched the Sandworm page for references to modems. A cited source referenced AcidRain as the malware involved.

MITRE ATT&CK Sandworm references related to modem targeting

I then opened the MITRE ATT&CK page for AcidRain to verify the association.

Answer:

AcidRain

Task 13: Which non-standard port was used for an SSH server?

I searched the Sandworm page for SSH and located the Non-Standard Port technique description. The entry documented the listening port used by the group.

MITRE ATT&CK non-standard port procedure example for Sandworm

Answer:

Task 14: Which APT group collaborated with Sandworm?

I reviewed the Sandworm group summary and related-group information. The page identified the collaborating group by its APT designation.

MITRE ATT&CK Sandworm page referencing APT28

Answer:

APT28

Investigation Summary

This Sherlock focused on using MITRE ATT&CK as a threat-intelligence research tool rather than simply looking up isolated answers. The investigation moved between group, campaign, software, and technique pages to connect Sandworm activity to specific adversary behaviors.

Category	Finding
Threat Actor	Sandworm Team / BlackEnergy Group / APT44
Operations Began	2009
2016 Campaign	Ukraine Electric Power Attack (`C0025`)
Credential Access	Brute Force (`T1110`) and LSASS Memory (`T1003.001`)
2016 Script	`ufn.vbs`
2022 Persistence	Web Shell (`T1505.003`)
Web Shell	Neo-REGEORG
SCADA Binary	`scilc.exe`
Destructive Malware	CaddyWiper
CaddyWiper Execution	Native API (`T1106`)
Worm-Like Malware	NotPetya
NotPetya Exploit Bulletin	`MS17-010`
Modem-Targeting Malware	AcidRain
Non-Standard SSH Port	`6789`
Collaborating Group	APT28

Key Takeaway

The main value of the lab was learning how to pivot through MITRE ATT&CK relationships. A single threat actor page can lead to campaigns, techniques, software, procedure examples, and cited reporting. ATT&CK Navigator then makes it easier to narrow a large campaign to the tactics relevant to a specific question.