Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Campaigns/C0025
MITRE ATT&CK Campaign · 2016–2016

2016 Ukraine Electric Power Attack (C0025)

ShareXLinkedInRedditHN

[2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign during which they used [Industroyer](https://attack.mitre.org/software/S0604) malware to target and disrupt distribution substations within the Ukrainian power grid. This campaign was the second major public attack conducted against Ukraine by [Sandworm Team](https://attack.mitre.org/groups/G0034).(Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)

▪Attributed groups (1)

G0034Sandworm Team

▪Techniques used (27)

T1059.005Visual BasicT1036.008Masquerade File TypeT1059.001PowerShell

▪Software used (1)

S0604Industroyermalware
C0025 on MITRE ATT&CK →
T1036.005Match Legitimate Resource Name or Location
T1505.001SQL Stored Procedures
T1136Create Account
T1685.001Disable or Modify Windows Event Log
T1570Lateral Tool Transfer
T1059.003Windows Command Shell
T1027Obfuscated Files or Information
T1543.003Windows Service
T1027.002Software Packing
T1036.010Masquerade Account Name
T1003.001LSASS Memory
T1047Windows Management Instrumentation
T1098Account Manipulation
T1110Brute Force
T1136.002Domain Account
T1018Remote System Discovery
T1554Compromise Host Software Binary
T1021.002SMB/Windows Admin Shares
T0867Lateral Tool Transfer
T0886Remote Services
T0853Scripting
T0859Valid Accounts
T0807Command-Line Interface
T0849Masquerading

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.