sandworm

name: sandworm description: "Sandworm (APT44 / Seashell Blizzard, GRU Unit 74455) adversary-emulation playbook — IT→OT intrusion ending in ICS manipulation or destructive impact, executed with living-off-the-land Windows tooling. SAFETY-CRITICAL: destructive and ICS-write steps are canary/lab-only and gated on explicit OT authorization. Use when emulating Sandworm against an ICS/OT or critical-infrastructure estate. Triggers on: 'emulate Sandworm', 'APT44', 'Seashell Blizzard', 'Voodoo Bear', 'ICS attack', 'OT destructive', 'Industroyer', 'NotPetya'." allowed-tools: Read Write Edit metadata: subdomain: planning when_to_use: "emulate Sandworm, APT44, Seashell Blizzard, Voodoo Bear, Telebots, GRU 74455, ICS OT attack, destructive wiper, Industroyer, NotPetya, critical infrastructure disruption, IT to OT pivot" tags: adversary-emulation, sandworm, apt44, ics-ot, destructive, critical-infrastructure mitre_attack: T1190, T1059.003, T1485, T1561.002, T0831, T0816

Sandworm — Adversary Emulation Playbook

Tier-3 Russian GRU (Unit 74455) sabotage actor. Sandworm's signature is a patient, living-off-the-land IT intrusion that crosses the IT/OT boundary and ends in physical or data destruction (Ukraine grid via Industroyer; NotPetya pseudo-ransomware wiper). This is the highest-risk emulation in the catalog. Every ICS-write and destructive step is canary/lab-only and gated on explicit operator + OT-engineer authorization.

When to emulate Sandworm

• Target operates ICS/OT or critical infrastructure (energy, water, manufacturing, transportation) and the client wants the IT→OT kill chain and destructive-impact resilience tested — typically as a tabletop-plus or against a dedicated OT lab segment.
• The client's threat model includes destructive/disruptive nation-state actors (see the industry → actor map in ../../references/apt-groups.md).

ThreatProfile seed (plan/threat-profile.json)

{
  "engagement_name": "<fill>",
  "actor_name": "Sandworm-like (APT44 / Seashell Blizzard)",
  "actor_aliases": ["Voodoo Bear", "Telebots", "IRON VIKING", "Seashell Blizzard", "APT44"],
  "group_id": "G0034",
  "tier": "tier-3",
  "sophistication": "nation-state",
  "motivation": "disruption",
  "initial_access": ["T1190", "T1566.001", "T1195.002", "T1133"],
  "key_ttps": ["T1059.003", "T1003.001", "T1021.002", "T1570", "T1485", "T1561.002", "T1486", "T0831", "T0816", "T0855"],
  "tools": ["NetExec", "Impacket", "Sliver", "pymodbus / python-snap7 (read-first)", "marked canary wiper (lab only)"],
  "infrastructure": ["Compromised edge/VPN foothold", "Engineering-workstation jump host (IT->OT pivot)", "Sliver HTTPS C2"],
  "recent_cti_delta": "2022 Industroyer2 against the Ukrainian power grid; sustained destructive operations vs Ukraine/NATO; LOTL with native Windows tools (vssadmin, wbadmin, bcdedit) before detonation.",
  "confidence": "probable"
}

Kill-chain emulation

CONOPS kill_chain (copy into conops.json)

1. recon — external surface + Purdue/IT-OT mapping + ICS fingerprint (row 1).
2. initial-access — edge exploit / spearphish / supply chain (2-4).
3. post-exploit — LSASS, IT lateral, IT→OT pivot, gated ICS read/write, canary destruction (5-9).
4. c2 — Sliver HTTPS (10).
5. exfiltration — optional espionage subset (engineering docs, PLC logic) if in scope.

OPSEC & signature fidelity

• Quiet until detonation. Sandworm stages with native Windows tools (cmd, vssadmin, wbadmin, bcdedit) and only becomes loud at the impact phase — mirror that: blend during staging, then a single controlled, authorized impact event.
• Mirror the IT→OT pivot. The fidelity-defining behavior is crossing the boundary via an engineering workstation, not the wiper binary.
• ICS reconnaissance is read-only and OPSEC-safe; the noise/risk is entirely in the write.

RoE / safety gates — READ BEFORE PLANNING

• ICS writes move physical actuators. Default to read-only enumeration. Any write/ control-class action requires explicit written OT-write authorization in the RoE and an OT safety engineer on the contact plan, per /skills/standard/exploit/ics-ot/SKILL.md ("SAFETY FIRST").
• Destruction is lab/canary only. Never run a real wiper or encryptor against production. Use a marked canary file set on an isolated lab host.
• abort.json MUST carry an EMERGENCY trigger (see /skills/standard/soundwave/abort-template/SKILL.md): "Tier-3 destructive emulation against critical infrastructure — halt + operator-page + 1hr cooldown" — plus "any ICS write outside the named lab test point."
• Schedule a maintenance window with physical safety standby before any OT step.

Deconfliction

• Notify the OT/SOC team and name the exact ICS test device(s) and coil/register addresses in deconfliction.json; nothing outside that list may be written.
• Tag the canary wiper artifact and Sliver implant with the engagement ID; record the lab host inventory in cleanup.json.

Fidelity notes (deviations)

• No real Industroyer/BlackEnergy/NotPetya samples. Emulate the sequence — IT foothold → LOTL lateral → engineering-workstation pivot → ICS command — with pymodbus/python-snap7 (read-first) and Sliver.
• The "manipulation of control" step is a single authorized benign write to a lab test point (e.g., toggle a non-safety-critical coil) with the OT engineer present, or fully simulated when no lab is available.
• The destructive finale is a canary-only proof that the access would allow impact — the deliverable distinguishes "impact demonstrated on canary" from "production impact" (never the latter).