Trusted Design

Sandworm to Blacken: The SCADA Connection

概要

On October 14th, a report was publicly released regarding the Sandworm team. After beginning an investigation into the affiliated malware samples and domains, we quickly came to realization that this group is very likely targeting SCADA-centric victims who are using GE Intelligent Platform’s CIMPLICITY HMI solution suite. We have observed this team utilizing .cim and .bcl files as attack vectors, both of which file types are used by the CIMPLICITY software. As further proof of the malware targeting CIMPILICITY, it drops files into the CIMPLICITY installation directory using the %CIMPATH% environment variable on the victim machines.

Created: 2026-02-23

Indicators

類似Pulses

このPulseに関連する脅威アクター (事実ベース)

Turla

Score: 6.63
Matched TTPs:
  • T1564.012 - File/Path Exclusions
  • T1587.001 - Malware
MITREへのリンク →

Kimsuky

Score: 16.53
Matched TTPs:
  • T1036.007 - Double File Extension
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1583.001 - Domains
  • T1027.002 - Software Packing
  • T1584.001 - Domains
MITREへのリンク →

Mustang Panda

Score: 20.73
Matched TTPs:
  • T1036.007 - Double File Extension
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
  • T1176.002 - IDE Extensions
  • T1027.007 - Dynamic API Resolution
  • T1003.003 - NTDS
MITREへのリンク →

Mustard Tempest

Score: 9.80
Matched TTPs:
  • T1583.008 - Malvertising
  • T1608.001 - Upload Malware
  • T1584.001 - Domains
MITREへのリンク →

FIN13

Score: 5.91
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
  • T1003.003 - NTDS
MITREへのリンク →

Moonstone Sleet

Score: 8.11
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

Lazarus Group

Score: 13.55
Matched TTPs:
  • T1587.001 - Malware
  • T1583.001 - Domains
  • T1036.003 - Rename Legitimate Utilities
  • T1027.007 - Dynamic API Resolution
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

Contagious Interview

Score: 8.11
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

OilRig

Score: 14.70
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1195 - Supply Chain Compromise
  • T1583.001 - Domains
  • T1573.002 - Asymmetric Cryptography
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

UNC3886

Score: 3.57
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
MITREへのリンク →

LuminousMoth

Score: 4.07
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
MITREへのリンク →

Sandworm Team

Score: 13.24
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1195 - Supply Chain Compromise
  • T1190 - Exploit Public-Facing Application
  • T1583.001 - Domains
  • T1003.003 - NTDS
MITREへのリンク →

Salt Typhoon

Score: 3.57
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
MITREへのリンク →

APT29

Score: 16.52
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
  • T1550.003 - Pass the Ticket
  • T1651 - Cloud Administration Command
  • T1027.002 - Software Packing
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

Play

Score: 3.57
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
MITREへのリンク →

Aoqin Dragon

Score: 4.15
Matched TTPs:
  • T1587.001 - Malware
  • T1027.002 - Software Packing
MITREへのリンク →

RedCurl

Score: 4.84
Matched TTPs:
  • T1587.001 - Malware
  • T1573.002 - Asymmetric Cryptography
MITREへのリンク →

Moses Staff

Score: 3.57
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
MITREへのリンク →

Ke3chang

Score: 5.91
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
  • T1003.003 - NTDS
MITREへのリンク →

TeamTNT

Score: 7.64
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
  • T1027.002 - Software Packing
MITREへのリンク →

FIN7

Score: 7.06
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1583.001 - Domains
MITREへのリンク →

TA2541

Score: 11.44
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
  • T1573.002 - Asymmetric Cryptography
  • T1027.002 - Software Packing
  • T1027.015 - Compression
MITREへのリンク →

Earth Lusca

Score: 4.96
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1583.001 - Domains
MITREへのリンク →

LazyScripter

Score: 3.49
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
MITREへのリンク →

Gamaredon Group

Score: 10.26
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
  • T1027.004 - Compile After Delivery
  • T1027.015 - Compression
MITREへのリンク →

Star Blizzard

Score: 3.49
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
MITREへのリンク →

Threat Group-3390

Score: 10.17
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1583.001 - Domains
  • T1027.002 - Software Packing
  • T1027.015 - Compression
MITREへのリンク →

SideCopy

Score: 5.26
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1584.001 - Domains
MITREへのリンク →

TA505

Score: 5.54
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
  • T1027.002 - Software Packing
MITREへのリンク →

BlackByte

Score: 3.44
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
MITREへのリンク →

BITTER

Score: 3.49
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
MITREへのリンク →

APT32

Score: 10.62
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
  • T1550.003 - Pass the Ticket
  • T1036.003 - Rename Legitimate Utilities
MITREへのリンク →

HEXANE

Score: 3.49
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
MITREへのリンク →

Saint Bear

Score: 4.03
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1027.002 - Software Packing
MITREへのリンク →

EXOTIC LILY

Score: 6.01
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

APT42

Score: 6.24
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.001 - Domains
  • T1573.002 - Asymmetric Cryptography
MITREへのリンク →

Ember Bear

Score: 5.31
Matched TTPs:
  • T1195 - Supply Chain Compromise
  • T1190 - Exploit Public-Facing Application
MITREへのリンク →

Rocke

Score: 7.14
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1027.004 - Compile After Delivery
  • T1027.002 - Software Packing
MITREへのリンク →

Volt Typhoon

Score: 5.86
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1027.002 - Software Packing
  • T1003.003 - NTDS
MITREへのリンク →

APT28

Score: 9.46
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1583.001 - Domains
  • T1003.003 - NTDS
  • T1211 - Exploitation for Defense Evasion
MITREへのリンク →

Magic Hound

Score: 8.80
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1583.001 - Domains
  • T1566.003 - Spearphishing via Service
  • T1584.001 - Domains
MITREへのリンク →

Medusa Group

Score: 13.15
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1573.002 - Asymmetric Cryptography
  • T1027.002 - Software Packing
  • T1003.003 - NTDS
  • T1218.014 - MMC
MITREへのリンク →

Sea Turtle

Score: 6.61
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1583.001 - Domains
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Storm-0501

Score: 3.52
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1027.002 - Software Packing
MITREへのリンク →

Fox Kitten

Score: 3.81
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1003.003 - NTDS
MITREへのリンク →

menuPass

Score: 8.61
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1583.001 - Domains
  • T1036.003 - Rename Legitimate Utilities
  • T1003.003 - NTDS
MITREへのリンク →

ToddyCat

Score: 3.99
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

Blue Mockingbird

Score: 6.01
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1574.012 - COR_PROFILER
MITREへのリンク →

GALLIUM

Score: 6.81
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1036.003 - Rename Legitimate Utilities
  • T1027.002 - Software Packing
MITREへのリンク →

Leviathan

Score: 6.14
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1583.001 - Domains
  • T1027.015 - Compression
MITREへのリンク →

Dragonfly

Score: 5.33
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1583.001 - Domains
  • T1003.003 - NTDS
MITREへのリンク →

Axiom

Score: 6.01
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1001.002 - Steganography
MITREへのリンク →

APT41

Score: 5.86
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1027.002 - Software Packing
  • T1003.003 - NTDS
MITREへのリンク →

HAFNIUM

Score: 3.81
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1003.003 - NTDS
MITREへのリンク →

MuddyWater

Score: 5.09
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1027.004 - Compile After Delivery
MITREへのリンク →

APT39

Score: 3.52
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1027.002 - Software Packing
MITREへのリンク →

Storm-1811

Score: 4.04
Matched TTPs:
  • T1583.001 - Domains
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

APT1

Score: 4.80
Matched TTPs:
  • T1583.001 - Domains
  • T1584.001 - Domains
MITREへのリンク →

Scattered Spider

Score: 3.86
Matched TTPs:
  • T1583.001 - Domains
  • T1003.003 - NTDS
MITREへのリンク →

Transparent Tribe

Score: 4.80
Matched TTPs:
  • T1583.001 - Domains
  • T1584.001 - Domains
MITREへのリンク →

ZIRCONIUM

Score: 3.57
Matched TTPs:
  • T1583.001 - Domains
  • T1027.002 - Software Packing
MITREへのリンク →

RedEcho

Score: 4.26
Matched TTPs:
  • T1583.001 - Domains
  • T1573.002 - Asymmetric Cryptography
MITREへのリンク →

APT38

Score: 6.86
Matched TTPs:
  • T1583.001 - Domains
  • T1036.003 - Rename Legitimate Utilities
  • T1027.002 - Software Packing
MITREへのリンク →

CURIUM

Score: 4.04
Matched TTPs:
  • T1583.001 - Domains
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

BRONZE BUTLER

Score: 3.84
Matched TTPs:
  • T1550.003 - Pass the Ticket
MITREへのリンク →

APT33

Score: 4.13
Matched TTPs:
  • T1552.006 - Group Policy Preferences
MITREへのリンク →

Wizard Spider

Score: 6.47
Matched TTPs:
  • T1552.006 - Group Policy Preferences
  • T1003.003 - NTDS
MITREへのリンク →

Daggerfly

Score: 3.29
Matched TTPs:
  • T1036.003 - Rename Legitimate Utilities
MITREへのリンク →

Velvet Ant

Score: 6.88
Matched TTPs:
  • T1573.002 - Asymmetric Cryptography
  • T1211 - Exploitation for Defense Evasion
MITREへのリンク →

FIN6

Score: 7.61
Matched TTPs:
  • T1573.002 - Asymmetric Cryptography
  • T1003.003 - NTDS
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

Dark Caracal

Score: 4.58
Matched TTPs:
  • T1027.002 - Software Packing
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

PLATINUM

Score: 4.54
Matched TTPs:
  • T1056.004 - Credential API Hooking
MITREへのリンク →

Molerats

Score: 3.15
Matched TTPs:
  • T1027.015 - Compression
MITREへのリンク →

Higaisa

Score: 3.15
Matched TTPs:
  • T1027.015 - Compression
MITREへのリンク →

Mofang

Score: 3.15
Matched TTPs:
  • T1027.015 - Compression
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Mustang Panda

Score: 0.79
Matched TTPs:
  • T1027.007 - Dynamic API Resolution
  • T1583.001 - Domains
  • T1036.007 - Double File Extension
  • T1608.001 - Upload Malware
  • T1176.002 - IDE Extensions
  • T1003.003 - NTDS
  • T1587.001 - Malware
MITREへのリンク →

APT29

Score: 0.64
Matched TTPs:
  • T1566.003 - Spearphishing via Service
  • T1651 - Cloud Administration Command
  • T1027.002 - Software Packing
  • T1190 - Exploit Public-Facing Application
  • T1550.003 - Pass the Ticket
  • T1587.001 - Malware
MITREへのリンク →

Kimsuky

Score: 0.63
Matched TTPs:
  • T1584.001 - Domains
  • T1583.001 - Domains
  • T1036.007 - Double File Extension
  • T1608.001 - Upload Malware
  • T1027.002 - Software Packing
  • T1190 - Exploit Public-Facing Application
  • T1587.001 - Malware
MITREへのリンク →

Sandworm Team

Score: 0.60
Matched TTPs:
  • T1583.001 - Domains
  • T1608.001 - Upload Malware
  • T1195 - Supply Chain Compromise
  • T1003.003 - NTDS
  • T1190 - Exploit Public-Facing Application
  • T1587.001 - Malware
MITREへのリンク →

OilRig

Score: 0.60
Matched TTPs:
  • T1573.002 - Asymmetric Cryptography
  • T1583.001 - Domains
  • T1566.003 - Spearphishing via Service
  • T1608.001 - Upload Malware
  • T1195 - Supply Chain Compromise
  • T1587.001 - Malware
MITREへのリンク →

Lazarus Group

Score: 0.57
Matched TTPs:
  • T1036.003 - Rename Legitimate Utilities
  • T1027.007 - Dynamic API Resolution
  • T1583.001 - Domains
  • T1566.003 - Spearphishing via Service
  • T1587.001 - Malware
MITREへのリンク →

Medusa Group

Score: 0.56
Matched TTPs:
  • T1573.002 - Asymmetric Cryptography
  • T1027.002 - Software Packing
  • T1218.014 - MMC
  • T1003.003 - NTDS
  • T1190 - Exploit Public-Facing Application
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る