APT GroupSOCRadar source-of-truth import; pending cross-source consensus confidence

ELECTRUM

ELECTRUM is a state-sponsored advanced persistent threat group, primarily known by its aliases Sandworm and APT44, that has been active since at least 2009, initially focusing on cyber espionage. The group, which is assessed to operate out of Russia, is distinguished by its pivot from intelligence gathering to highly destructive cyberattacks that specifically target critical infrastructure, particularly within Ukraine. ELECTRUM's primary motivation is to further Russia's strategic geopolitical objectives through disruptive and damaging cyber operations. This group is notable for its capability to achieve physical-world impacts through cyberattacks, such as power outages, and for its association with the NotPetya attack. While recognized under various names, ELECTRUM is consistently linked to the Sandworm Team and their extensive history of destructive campaigns.

Directory Briefing

Top 10 Talking Points

ELECTRUM should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.^1,2

The retained behavior points to Valid Accounts, Supply Chain Compromise, and Phishing; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

The retained sequence includes System Network Configuration Discovery, System Information Discovery, File and Directory Discovery, System Time Discovery, and OS Credential Dumping, which supports scoping beyond the initially affected host.

Identity compromise is a central scoping issue.^1,2

Evidence includes OS Credential Dumping, LSASS Memory, Brute Force, and Unsecured Credentials; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

Persistence matters more than the first payload.^1,2

Retained persistence behavior includes Scheduled Task/Job, Scheduled Task, SSH Authorized Keys, and Web Shell; removing malware without closing those access paths can leave the actor operational.

Legitimate administration tools may carry much of the attack.^1,2

Reported tooling or behavior includes Remote Services, Remote Desktop Protocol, SMB/Windows Admin Shares, SSH, Windows Management Instrumentation, and Command and Scripting Interpreter; detection must distinguish authorized administration from anomalous context and sequence.

The actor may reduce visibility before the main objective is reached.^1,2

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

Collection and exfiltration reveal the likely mission.^1,2

The retained record includes Data from Local System, Exfiltration Over C2 Channel, Exfiltration Over Alternative Protocol, and Exfiltration Over Asymmetric Encrypted Non-C2 Protocol, making repository, email, cloud, and egress review central to impact assessment.

Victimology is broad enough that sector alone is weak negative evidence.¹

Retained targeting includes Mining, Transportation&Warehousing, Finance, Public Administration, and Electrical&Electronical Manufacturing across Ukraine; translate those sectors into the organization's exposed systems and high-value data.

The first briefing should separate containment confidence from attribution confidence.^1,2

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Bottom Line Up Front

BLUF

ELECTRUM should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.^1,2

The retained behavior points to Valid Accounts, Supply Chain Compromise, and Phishing; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

Identity compromise is a central scoping issue.^1,2

Persistence matters more than the first payload.^1,2

Retained persistence behavior includes Scheduled Task/Job, Scheduled Task, SSH Authorized Keys, and Web Shell; removing malware without closing those access paths can leave the actor operational.

Legitimate administration tools may carry much of the attack.^1,2

The actor may reduce visibility before the main objective is reached.^1,2

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

Collection and exfiltration reveal the likely mission.^1,2

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.^1,2

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Decision Context

Executive Summary

Actor Card Detail

Actor Profile

Entity Type^1,2

APT Group profile

First Seen^1,2

2009-01-01

Last Seen^1,2

2025-12-31

Origin^1,2

Motivation^1,2

Information theft and espionage,Sabotage and destruction

Primary Access Pattern^1,2

T1001 - Data Obfuscation

Objective^1,2

Information theft and espionage,Sabotage and destruction

Victimology

Named Victims / Public Disclosures

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

Identity

Aliases And Boundaries

Aliases^1,2

APT44Blue EchidnaSandwormFROZENBARENTSG0034IRIDIUMIRON VIKINGQuedaghSeashell BlizzardTEMP.NobleTeleBotsUAC-0082UAC-0113VOODOO BEARSandworm TeamELECTRUMBlackEnergy (Group)

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure¹

Ukraine

Target Sectors¹

MiningTransportation&WarehousingFinancePublic AdministrationElectrical&Electronical ManufacturingRail TransportationAir TransportationManufacturingOil & GasEducational ServicesInternet PublishingEnergy & UtilitiesInsuranceRemediation and Other Waste Management ServicesBusiness Schools and Computer and Management TrainingOther Amusement and Recreation IndustriesCivic and Social OrganizationsElectric Power Transmission, Control, and DistributionPeriodical PublishersMotion Picture and Video ProductionData Processing, Hosting, and Related ServicesEngineering ServicesComputer Systems Design and Related ServicesEnvironmental Consulting ServicesNational Security&International AffairsTelecommunicationsOtherHealthCare & Social AssistanceNational SecuritySporting and Athletic Goods ManufacturingComputer Systems Design Services

Associated Activity^1,2

Initial Access: Observed spear-phishing campaigns leveraging malicious attachments or links.Initial Access: Exploitation of vulnerabilities in remote management software (e.g., CVE-2024-1709 in ConnectWise ScreenConnect) or security software (e.g., CVE-2023-48788 in Fortinet FortiClient EMS).Initial Access: Compromise of software supply chains, including malicious updates to legitimate applications (e.g., M.E.Doc).Execution: Deployment and execution of destructive malware such as NotPetya, Industroyer, KillDisk, CaddyWiper, or Industroyer2.Execution: Use of PowerShell for command execution and payload delivery (T1059.001).Defense Evasion: Disabling of event logging on compromised systems (T1070).Defense Evasion: Masquerading malicious binaries or files as legitimate system components (e.g., explorer.exe) or common file types (e.g., .txt files) (T1036).Persistence: Installation of backdoors (e.g., Kapeka) or establishing persistent footholds (e.g., Cyclops Blink on network devices).Reconnaissance: System information discovery, including querying the registry (T1012) and Active Directory (T1082).Credential Access: OS credential dumping (T1003) or unauthorized access to administrative credentials.Lateral Movement: Use of legitimate tools like PsExec or WMI for movement across the network.Command and Control: Suspicious network traffic to uncommon domains or C2 communications proxied via TLS-based tunnels (T1102.002).Impact: Unexpected system reboots, crashes, or operational disruptions in industrial control systems leading to power outages or equipment damage (T1489).

ATT&CK IDs^1,2

T1001 - Data ObfuscationT1003 - OS Credential DumpingT1003.001 - LSASS MemoryT1003.003T1005 - Data from Local SystemT1007T1008 - Fallback ChannelsT1010T1011T1012 - Query RegistryT1016 - System Network Configuration DiscoveryT1018T1020T1021 - Remote ServicesT1021.001 - Remote Desktop ProtocolT1021.002 - SMB/Windows Admin SharesT1021.004 - SSHT1027 - Obfuscated Files or InformationT1027.002T1027.010T1033T1036 - MasqueradingT1036.004T1036.005 - Match Legitimate Name or LocationT1036.008T1036.010T1040T1041 - Exfiltration Over C2 ChannelT1046T1047 - Windows Management InstrumentationT1048 - Exfiltration Over Alternative ProtocolT1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolT1049T1053 - Scheduled Task/JobT1053.005 - Scheduled TaskT1055T1056 - Input CaptureT1056.001T1057T1059 - Command and Scripting InterpreterT1059.001 - PowerShellT1059.003 - Windows Command ShellT1059.005 - Visual BasicT1060T1064T1068T1070 - Indicator Removal on HostT1070.004 - File DeletionT1071 - Application Layer ProtocolT1071.001 - Web ProtocolsT1072 - Software Deployment ToolsT1078 - Valid AccountsT1078.002T1081T1082 - System Information DiscoveryT1083 - File and Directory DiscoveryT1085T1087T1087.002T1087.003T1090 - ProxyT1090.002 - External ProxyT1090.003 - Multi-hop ProxyT1095 - Non-Application Layer ProtocolT1098T1098.004 - SSH Authorized KeysT1102T1102.002T1104 - Multi-Stage ChannelsT1105 - Ingress Tool TransferT1106 - Native APIT1110 - Brute ForceT1112T1113 - Screen CaptureT1114T1114.001T1115T1119T1120T1123T1124 - System Time DiscoveryT1125 - Video CaptureT1127T1130T1132T1132.001T1133T1135 - Network Share DiscoveryT1136T1136.002T1137T1140 - Deobfuscate/Decode Files or InformationT1170T1176T1187 - Forced AuthenticationT1190T1195 - Supply Chain CompromiseT1195.002T1199T1203T1204 - User ExecutionT1204.001T1204.002 - Malicious FileT1205T1213T1213.006T1217T1218 - Signed Binary Proxy ExecutionT1218.011T1219 - Remote Access SoftwareT1484T1484.001T1485 - Data DestructionT1486 - Data Encrypted for ImpactT1489T1490 - Inhibit System RecoveryT1491T1491.002T1496 - Resource HijackingT1497 - Virtualization/Sandbox EvasionT1497.003T1498T1499T1503T1505T1505.001T1505.003 - Web ShellT1518T1528T1529 - System Shutdown/RebootT1531T1539T1543 - Create or Modify System ProcessT1543.002T1543.003T1547 - Boot or Logon Autostart ExecutionT1547.001 - Registry Run Keys / Startup FolderT1548 - Abuse Elevation Control MechanismT1550 - Use Alternate Authentication MaterialT1552 - Unsecured CredentialsT1552.004 - Private KeysT1553 - Subvert Trust ControlsT1554T1555 - Credentials from Password StoresT1555.003T1560T1561 - Disk WipeT1561.001 - Disk Content WipeT1561.002T1562 - Impair DefensesT1562.001T1562.002T1564T1566 - PhishingT1566.001T1566.002T1569 - System ServicesT1570 - Lateral Tool TransferT1571T1572 - Protocol TunnelingT1573 - Encrypted ChannelT1573.002 - Asymmetric CryptographyT1583T1583.001T1583.003 - Virtual Private ServerT1583.004T1584T1584.004 - ServerT1584.005T1585T1585.001T1585.002T1586T1586.001T1587T1587.001T1588T1588.002T1588.006T1589T1589.002T1589.003 - Employee NamesT1590T1590.001T1591T1591.002T1592T1592.002T1593T1594T1595 - Active ScanningT1595.002T1596 - Search Open Technical DatabasesT1598T1598.003T1608T1608.001TA0004

Campaign Context

Associated Campaigns / Operations

Campaign / Operation	Source-Backed Context
2015 Ukraine Electric Power Attack²	2015 Ukraine Electric Power Attack (C0028) is attributed to Sandworm Team (G0034) by MITRE ATT&CK Campaigns.
2016 Ukraine Electric Power Attack²	2016 Ukraine Electric Power Attack (C0025) is attributed to Sandworm Team (G0034) by MITRE ATT&CK Campaigns.
2022 Ukraine Electric Power Attack²	2022 Ukraine Electric Power Attack (C0034) is attributed to Sandworm Team (G0034) by MITRE ATT&CK Campaigns.

Indicators

IOCs And Observable Retention

SOCRadar reported 1642¹IntelliOS retained 111^{2,4,5,6,7,8,9,10}

SOCRadar reports 1642 IOCs for this profile. IntelliOS currently retains 111 cited public observable/context rows; this is not the full possible public-source IOC corpus.

Source coverage: 9 source groups tracked; 8 currently contribute retained observable or context rows.

Retained Observables

Showing 60 of 111

Type	Value	Source
SHA-256 Hash	018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81⁶	ESET malware-ioc
SHA-256 Hash	02de7fc923ae66efb90cc7767a3d63d15219bc5ef299e95b5299914513de8960⁸	ESET malware-ioc
SHA-256 Hash	095c7fa99dbc1ed7a3422a52cc61044ae4a25f7f5e998cc53de623f49da5da43⁸	ESET malware-ioc
SHA-256 Hash	0db5e5b68dc4b8089197de9c1e345056f45c006b7b487f7d8d57b49ae385bad0⁸	ESET malware-ioc
SHA-256 Hash	146dba965218487b292be437c581e905215f4f6a81267c161f73d6abc25481a5⁸	ESET malware-ioc
SHA-256 Hash	168b1b535d6cb7f0accbdbb9f68e5cf405169b5303e95ae63151c810d02b262d¹⁰	ESET malware-ioc
SHA-256 Hash	1aa8aeee9e4ec576c13fd21f9a2b92cf1cdacb0f8ded8550a7f1c5935ffba1de⁸	ESET malware-ioc
SHA-256 Hash	1d19bc1785fad34633bb808960e22084ae615a1c66e7d0e93bb314460600b333⁸	ESET malware-ioc
SHA-256 Hash	1e36cc5d0653910253396dbfba8a4b3ab87af592e8842c3afa70c3043964cb37⁸	ESET malware-ioc
SHA-256 Hash	1fb8c4ceb17cfc5337f385eb7018c589cafda804743d7bc442b97bef47371e90¹⁰	ESET malware-ioc
SHA-256 Hash	21c1fdd6cfd8ec3ffe3e922f944424b543643dbdab99fa731556f8805b0d5561⁶	ESET malware-ioc
SHA-256 Hash	26173c9ec8fd1c4f9f18f89683b23267f6f9d116196ed15655e9cb453af2890e¹⁰	ESET malware-ioc
SHA-256 Hash	2b804ddbdbbf06f91ce9e313eecb8614ded7a3ed2c23b1e4ad574ad2e77341e7⁸	ESET malware-ioc
SHA-256 Hash	2ee5a743bd420aa04e0ea9ab7a25e1cc2c346a55d6a518f267896694d75539a2¹⁰	ESET malware-ioc
SHA-256 Hash	300bf84e749446640dfead36013354ceafcb2a3c21fd9ba4e12f8379e76e414c⁸	ESET malware-ioc
SHA-256 Hash	305e634a85df6146c76935ad1bcc77f128ec355f2087c033437afc7b415bc942⁸	ESET malware-ioc
SHA-256 Hash	34bf49015137cbf58aa7f9643bf0476d28e1e0ffdec265103beacec30b54c57f¹⁰	ESET malware-ioc
SHA-256 Hash	37d54e3d5e8b838f366b9c202f75fa264611a12444e62ae759c31a0d041aa6e4⁶	ESET malware-ioc
SHA-256 Hash	3e3ab9674142dec46ce389e9e759b6484e847f5c1e1fc682fc638fc837c13571⁶	ESET malware-ioc
SHA-256 Hash	3f300a8ca12a8f53fb184d2f60fe7accbb0b9b4449c45d47920030f3557a2362¹⁰	ESET malware-ioc
SHA-256 Hash	41ed91687521de1e7e9ec67268c58aed797090078c33f1dc607db18800b4d469⁸	ESET malware-ioc
SHA-256 Hash	4a56ae77eee172a5290dd228b701cb7ce7c7aa5d5af3cd608e44223f01a4ae5b¹⁰	ESET malware-ioc
SHA-256 Hash	4f35d1ce0e434d4c7ad645e877d1bbac6395dcc6e082e222df6b3c500268a53e⁸	ESET malware-ioc
SHA-256 Hash	50b990f6555055a265fde98324759dbc74619d6a7c49b9fd786775299bf77d26¹⁰	ESET malware-ioc
SHA-256 Hash	513d3fd092d2c22071e9a4a24dca8d2b7f9d146f3075e736f374d9e315ec018e⁸	ESET malware-ioc
SHA-256 Hash	52eeeeabe6c09330a74f0a1a45f29d52204f57d136de7e750640d69e7e797fb1¹⁰	ESET malware-ioc
SHA-256 Hash	5f9fef7974d37922ac91365588fbe7b544e13abbbde7c262fe30bade7026e118¹⁰	ESET malware-ioc
SHA-256 Hash	601aa77c83dc68d22ce2f888f36ebfb5de6ef3c2ef3a6b7a245076c1d06f0f2e¹⁰	ESET malware-ioc
SHA-256 Hash	6281bf74fd8db3c2acd2967bcef0d2a4a9b2b2c8ae54ddb88e555be53b49e3b9⁸	ESET malware-ioc
SHA-256 Hash	629cd368514fa4fbe76449568a740d58d205bfabc3d2bf45644d62d2268278d5¹⁰	ESET malware-ioc
SHA-256 Hash	6b1ca788460fdb8d3707a46fa4acd58bd40502f1b9cea220d929fce944d45de7⁸	ESET malware-ioc
SHA-256 Hash	6c52a5850a57bea43a0a52ff0e2d2179653b97ae5406e884aee63e1cf340f58b⁸	ESET malware-ioc
SHA-256 Hash	6d707e647427f1ff4a7a9420188a8831f433ad8c5325dc8b8cc6fc5e7f1f6f47⁶	ESET malware-ioc
SHA-256 Hash	7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad⁶	ESET malware-ioc
SHA-256 Hash	7e154d5be14560b8b2c16969effdb8417559758711b05615513d1c84e56be076⁸	ESET malware-ioc
SHA-256 Hash	83527cb8d228fcab3314f9631979c6752239ca45c6ea858cc8d974615a71c5cb¹⁰	ESET malware-ioc
SHA-256 Hash	893e4cca7fe58191d2f6722b383b5e8009d3885b5913dcd2e3577e5a763cdb3f⁶	ESET malware-ioc
SHA-256 Hash	8ad201eabb8eccce639c402c95be73daf5ade3668a069aef3ef704f03b98b57e⁸	ESET malware-ioc
SHA-256 Hash	8c8e38ffcaa89d5793973c1b0b7eb9bc419963f96ba10088010eb68b881f33b0⁸	ESET malware-ioc
SHA-256 Hash	904df5d6b900fcdac44c002f03ab1fbc698b8d421a22639819b3b208aaa6ea2c¹⁰	ESET malware-ioc
SHA-256 Hash	97b317afa02cd35db40c197fea3a6ef8cdc8c01ca73523983850f323a47d0c2e¹⁰	ESET malware-ioc
SHA-256 Hash	9df76b532c90d19a92138dd6b395b580330fcd87bab53240b436640e80895ed1⁸	ESET malware-ioc
SHA-256 Hash	a260320bb52eb0fe767d7e30e069492ab063b65a26969dd78d10d8141b850bc8¹⁰	ESET malware-ioc
SHA-256 Hash	ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910⁶	ESET malware-ioc
SHA-256 Hash	b2edc9351b389f1cbcdf0ac52b9d0b3bd982a077e5a3df8cebebc32c450ffeec¹⁰	ESET malware-ioc
SHA-256 Hash	b8d96077b5fb92da2ccad3582ec907af5281b511270ca5d9f3043da63fb94a0a⁸	ESET malware-ioc
SHA-256 Hash	c0514d9176d324bb03854e2c897109842d1aaec38f7d8d22cd9d3dc6a8110af7⁸	ESET malware-ioc
SHA-256 Hash	c7014820eb40013140c272c33c4adfec6118d110045d88b9cba2e33693cf0c76¹⁰	ESET malware-ioc
SHA-256 Hash	cfe9af8463d1fc84c736d469feb7d941f7da5f0989b0c82ce08369cc9dc5beb5⁸	ESET malware-ioc
SHA-256 Hash	d106c5427276d5f4afe48dd2c9fe6c5e05da6a38ced8ffd96028d5169a49bc70⁸	ESET malware-ioc
SHA-256 Hash	d1f82b0921401ac75d2d177d7d92de2af67204d422891a3dcffbb1e069903d27⁸	ESET malware-ioc
SHA-256 Hash	d8f682146f3a7d85f77e1045e253b7a2f502a37d0ba067b6761ac4177b04d6b1⁸	ESET malware-ioc
SHA-256 Hash	dcade5e14c26c19e935b13d5170d74f99e75d3e4dba443db1dab8bea78745584⁸	ESET malware-ioc
SHA-256 Hash	dcdc4c72c6e0867e74790a882e8e8c20e8a38416e9b10ed64fbf0f64f4e2567c¹⁰	ESET malware-ioc
SHA-256 Hash	e168518786fe712f67078450a15cea3a1acb8d1dc2170d8238b2e967cbbdd445¹⁰	ESET malware-ioc
SHA-256 Hash	e3f134ae88f05463c4707a80f956a689fba7066bb5357f6d45cba312ad0db68e¹⁰	ESET malware-ioc
SHA-256 Hash	e58fc756f31aa114bd8f5833ed21b385e78daf739189301e3808ad3b4abc400b⁸	ESET malware-ioc
SHA-256 Hash	e85d04229097febd9445716c2a399f253589c56b917a0d91a7cbae757efa836b⁸	ESET malware-ioc
SHA-256 Hash	ea47f5209142e05f511965906e1558349f805dde08118b3c1b45b8a0367d9dc6⁸	ESET malware-ioc
SHA-256 Hash	ea57a45dda5b735fc2a982700a21363cbee138de2605d1df06103a5d94c539da¹⁰	ESET malware-ioc

Show remaining 51 observables

SHA-256 Hash	eb31a918ccc1643d069cf08b7958e2760e8551ba3b88ea9e5d496e07437273b2¹⁰	ESET malware-ioc
SHA-256 Hash	ecaf150e087ddff0ec6463c92f7f6cca23cc4fd30fe34c10b3cb7c2a6d135c77⁶	ESET malware-ioc
SHA-256 Hash	f02db97b5cc183e58818543cd6c17909e0c151753382dd90421b3557f41c3707⁸	ESET malware-ioc
SHA-256 Hash	f128b2df388c273e22e859a2308a546728aaded67b4999f780df03724b94f01a¹⁰	ESET malware-ioc
SHA-256 Hash	f50ee030224bf617ba71d88422c25d7e489571bc1aba9e65dc122a45122c9321⁸	ESET malware-ioc
Tool / Process	BlackEnergy²	MITRE
Tool / Process	GreyEnergy²	MITRE
Tool / Process	Industroyer²	MITRE
Tool / Process	Industroyer2²	MITRE
Tool / Process	KillDisk²	MITRE
Tool / Process	NotPetya²	MITRE
Tool / Process	Olympic Destroyer²	MITRE
Tool / Process	Prestige²	MITRE
Tool / Process	WhisperGate²	MITRE
Network Indicator	api.telegram.org⁹	ESET malware-ioc
Network Indicator	smtp-mail.outlook.com⁹	ESET malware-ioc
Network Indicator	srv70.putdrive.com⁹	ESET malware-ioc
Network Indicator	109.200.202.7⁷	ESET malware-ioc
Network Indicator	124.217.254.55⁷	ESET malware-ioc
Network Indicator	138.201.198.164⁷	ESET malware-ioc
Network Indicator	149.154.167.197⁹	ESET malware-ioc
Network Indicator	149.154.167.198⁹	ESET malware-ioc
Network Indicator	149.154.167.199⁹	ESET malware-ioc
Network Indicator	149.154.167.200⁹	ESET malware-ioc
Network Indicator	163.172.7.195⁷	ESET malware-ioc
Network Indicator	163.172.7.196⁷	ESET malware-ioc
Network Indicator	176.121.10.137⁷	ESET malware-ioc
Network Indicator	176.31.116.140⁷	ESET malware-ioc
Network Indicator	178.150.0.200⁷	ESET malware-ioc
Network Indicator	178.255.40.194⁷	ESET malware-ioc
Network Indicator	185.216.33.126⁷	ESET malware-ioc
Network Indicator	185.217.0.121⁷	ESET malware-ioc
Network Indicator	188.165.14.185⁹	ESET malware-ioc
Network Indicator	193.105.134.56⁷	ESET malware-ioc
Network Indicator	193.105.134.68⁷	ESET malware-ioc
Network Indicator	213.239.202.149⁷	ESET malware-ioc
Network Indicator	217.12.202.111⁷	ESET malware-ioc
Network Indicator	31.148.220.112⁷	ESET malware-ioc
Network Indicator	37.59.14.94⁷	ESET malware-ioc
Network Indicator	46.249.49.231⁷	ESET malware-ioc
Network Indicator	5.149.248.77⁷	ESET malware-ioc
Network Indicator	62.210.77.169⁷	ESET malware-ioc
Network Indicator	65.55.176.126⁹	ESET malware-ioc
Network Indicator	80.233.134.147⁹	ESET malware-ioc
Network Indicator	85.25.211.10⁷	ESET malware-ioc
Network Indicator	88.198.13.116⁷	ESET malware-ioc
Network Indicator	93.190.137.212⁹	ESET malware-ioc
Network Indicator	94.130.88.50⁷	ESET malware-ioc
Network Indicator	95.141.37.3⁹	ESET malware-ioc
Campaign Context	CISA AA22-110A describes Sandworm-linked activity against Ukrainian critical infrastructure and frames Industroyer2 as part of the defensive scoping context.⁴	CISA AA22-110A
Campaign Context	ESET Industroyer repository retains public sample hashes for the malware family associated with Sandworm/ELECTRUM disruptive operations.⁵	ESET malware-ioc

Source	Reported	Retained	Coverage Status
SOCRadar¹	1642	0	Reported IOC count retained; underlying SOCRadar feed values are not republished unless stored as cited public observables.
MITRE ATT&CK²	N/A	9	Public observables or source-context rows retained and displayed.
CISA⁴	N/A	1	Public observables or source-context rows retained and displayed.
ESET malware-ioc⁵	N/A	1	Public observables or source-context rows retained and displayed.
ESET malware-ioc⁶	N/A	9	Public observables or source-context rows retained and displayed.
ESET malware-ioc⁷	N/A	23	Public observables or source-context rows retained and displayed.
ESET malware-ioc⁸	N/A	32	Public observables or source-context rows retained and displayed.
ESET malware-ioc⁹	N/A	12	Public observables or source-context rows retained and displayed.
ESET malware-ioc¹⁰	N/A	24	Public observables or source-context rows retained and displayed.

Actor Chronology

Observed Activity Timeline

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

IntelliOS Intel Products

Linked Products

None Found

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	ELECTRUM	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	ELECTRUM	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for ELECTRUM.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor	Threat actor directory source for profile fields and reported activity.
2	MITRE ATT&CK https://attack.mitre.org/groups/G0034	ATT&CK source for group, campaign, software, alias, and technique mappings where matched.
3	MITRE CTI https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json	Open MITRE CTI source for ATT&CK data.
4	CISA AA22-110A: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a	Government Advisory
5	ESET malware-ioc: Industroyer README https://raw.githubusercontent.com/eset/malware-ioc/master/industroyer/README.adoc	IOC Repository
6	ESET malware-ioc: Industroyer SHA-256 samples https://raw.githubusercontent.com/eset/malware-ioc/master/industroyer/samples.sha256	IOC Repository
7	ESET malware-ioc: GreyEnergy README https://raw.githubusercontent.com/eset/malware-ioc/master/greyenergy/README.adoc	IOC Repository
8	ESET malware-ioc: GreyEnergy SHA-256 samples https://raw.githubusercontent.com/eset/malware-ioc/master/greyenergy/samples.sha256	IOC Repository
9	ESET malware-ioc: TeleBots README https://raw.githubusercontent.com/eset/malware-ioc/master/telebots/README.adoc	IOC Repository
10	ESET malware-ioc: TeleBots SHA-256 samples https://raw.githubusercontent.com/eset/malware-ioc/master/telebots/samples.sha256	IOC Repository

Loading Threat Actor Cards

ELECTRUM

Top 10 Talking Points

ELECTRUM should be treated as an intrusion cluster, not a single immutable toolkit.1,2

Initial access should be scoped across identity and Internet-facing systems.1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.1,2

Identity compromise is a central scoping issue.1,2

Persistence matters more than the first payload.1,2

Legitimate administration tools may carry much of the attack.1,2

The actor may reduce visibility before the main objective is reached.1,2

Collection and exfiltration reveal the likely mission.1,2

Victimology is broad enough that sector alone is weak negative evidence.1

The first briefing should separate containment confidence from attribution confidence.1,2

BLUF

ELECTRUM should be treated as an intrusion cluster, not a single immutable toolkit.1,2

Initial access should be scoped across identity and Internet-facing systems.1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.1,2

Identity compromise is a central scoping issue.1,2

Persistence matters more than the first payload.1,2

Legitimate administration tools may carry much of the attack.1,2

The actor may reduce visibility before the main objective is reached.1,2

Collection and exfiltration reveal the likely mission.1,2

Victimology is broad enough that sector alone is weak negative evidence.1

The first briefing should separate containment confidence from attribution confidence.1,2

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

ELECTRUM should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Initial access should be scoped across identity and Internet-facing systems.^1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

Identity compromise is a central scoping issue.^1,2

Persistence matters more than the first payload.^1,2

Legitimate administration tools may carry much of the attack.^1,2

The actor may reduce visibility before the main objective is reached.^1,2

Collection and exfiltration reveal the likely mission.^1,2

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.^1,2

ELECTRUM should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Initial access should be scoped across identity and Internet-facing systems.^1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

Identity compromise is a central scoping issue.^1,2

Persistence matters more than the first payload.^1,2

Legitimate administration tools may carry much of the attack.^1,2

The actor may reduce visibility before the main objective is reached.^1,2

Collection and exfiltration reveal the likely mission.^1,2

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.^1,2