{
  "id": "sandworm",
  "name": "Sandworm Team",
  "aliases": [
    "APT44",
    "Seashell Blizzard",
    "Voodoo Bear",
    "IRON VIKING"
  ],
  "domain": "cyber",
  "country": "RUS",
  "category": "State-sponsored cyber threat group",
  "status": "active",
  "fielded": null,
  "operators": [
    "RUS"
  ],
  "summary": "Destructive cyber threat group attributed to Russia's GRU Main Center for Special Technologies (GTsST), military unit 74455.",
  "specs": [
    {
      "k": "sponsor",
      "v": "GRU GTsST, military unit 74455",
      "src": [
        "mitre-g0034"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2009,
      "src": [
        "mitre-g0034"
      ],
      "conf": "medium"
    },
    {
      "k": "attack_id",
      "v": "G0034",
      "src": [
        "mitre-g0034"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Electric power, government, transportation and logistics (Ukraine, Georgia, Poland)",
      "src": [
        "mitre-g0034"
      ],
      "conf": "medium"
    },
    {
      "k": "campaigns",
      "v": "Ukraine power attacks (2015, 2016, 2022); NotPetya (2017); Olympic Destroyer (2018)",
      "src": [
        "mitre-g0034"
      ],
      "conf": "medium"
    }
  ],
  "verified": null,
  "changelog": [
    {
      "date": "2026-10-03",
      "change": "Initial draft entry from cited open sources"
    },
    {
      "date": "2026-10-03",
      "change": "Added identification art"
    }
  ],
  "art": "cyber",
  "image": null,
  "payloads": [],
  "url": "https://www.defensepedia.com/systems/sandworm.html",
  "sources": {
    "mitre-g0034": {
      "title": "Sandworm Team, Group G0034",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0034/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-10-03"
    }
  }
}