Threat intelligence / Campaign

2022 Ukraine Electric Power Attack

The [2022 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0034) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign that used a combination of GOGETTER, Neo-REGEORG, [CaddyWiper](https://attack.mitre.org/software/S0693), and living of the land (LotL) techniques to gain access to a Ukrainian electric utility to send unauthorized commands from their SCADA system.(Citation: Mandiant-Sandworm-Ukraine-2022)(Citation: Dragos-Sandworm-Ukraine-2022)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

The [2022 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0034) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign that used a combination of GOGETTER, Neo-REGEORG, [CaddyWiper](https://attack.mitre.org/software/S0693), and living of the land (LotL) techniques to gain access to a Ukrainian electric utility to send unauthorized commands from their SCADA system.(Citation: Mandiant-Sandworm-Ukraine-2022)(Citation: Dragos-Sandworm-Ukraine-2022)

12 recorded

Relationships

attributed-to

to Sandworm Team

Group

uses

Malware

uses

to Data Destruction

Technique

uses

to Group Policy Modification

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Masquerade Task or Service

Technique

uses

to Non-Application Layer Protocol

Technique

uses

Technique

uses

to Protocol Tunneling

Technique

uses

to Scheduled Task

Technique

uses

to Systemd Service

Technique

uses

Technique

3 external

References

mitre-attack

C0034

Dragos-Sandworm-Ukraine-2022

https://www.dragos.com/blog/new-details-electrum-ukraine-electric-sector-compromise-2022/

Mandiant-Sandworm-Ukraine-2022

https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology