PRIMARY SOURCE DB
MITRE ATT&CK v15.1
Page built 2026-11-12
Data as of November 12, 2026 at 05:15 UTC
Search
CISA, FBI & NSA ADVISORY

AA24-057A: Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure

Published: 2024-02-27 • Issuing Agency: CISA, FBI & NSA • Official CISA Release ↗

Key Facts

  • Official advisory designation: AA24-057A.
  • Published on 2024-02-27 by CISA, FBI & NSA.
  • Directly correlated with 4 primary case dossier(s) in this library.
  • Provides joint government TTPs, MITRE ATT&CK indicators, and prioritized enterprise mitigations.

Referenced Common Vulnerabilities and Exposures (CVEs)

CVE-2023-38606 (NVD ↗)

Related Primary Court Cases & Incident Forensics

U.S. v. Andrienko et al. (Sandworm / GRU Unit 74455)

fugitive 2020-10-15

Six Russian Main Intelligence Directorate (GRU) military officers charged with deploying the NotPetya wiper, Olympic Destroyer malware, KillDisk attacks against Ukrainian power grids, and cyberattacks targeting French elections.

Infiltration Vector: Supply-chain compromise of Ukrainian tax accounting software M.E.Doc (Intellect Service). Threat actors infiltrated the vendor's update infrastructure and backdoored the routine update binary ezvit.exe to deploy a malicious loader across thousands of corporate networks.
10 techniques mapped · Loss: $10.0 billion View full case dossier →

U.S. v. Netyksho et al. (APT28 / GRU Unit 26165 DNC Hack)

fugitive 2018-07-13

Twelve Russian GRU military intelligence officers charged with hacking into the Democratic National Committee and Hillary Clinton presidential campaign servers, exfiltrating emails, and orchestrating strategic leaks via DCLeaks and Guccifer 2.0.

Infiltration Vector: Adversary gained initial access via Spearphishing Link: Conspirators sent spearphishing emails containing spoofed Google security warnings directing campaign staff to enter passwords on adversary domains.
5 techniques mapped · Loss: $10.0 million View full case dossier →

U.S. & International Action: Dmitry Badin (German Bundestag Hack)

fugitive 2020-05-05

Russian GRU military officer charged with the 2015 cyber intrusion into the German Federal Parliament (Bundestag), which compromised parliamentary IT infrastructure and exfiltrated thousands of emails from Chancellor Angela Merkel's office.

Infiltration Vector: Adversary gained initial access via Spearphishing Attachment: Attackers sent spearphishing emails with malicious attachments disguised as United Nations newsletters to German members of parliament.
1 techniques mapped · Loss: $15.0 million View full case dossier →

Ukraine Electrical Substation Cyber Warfare Blackout

charged 2015-12-23

First confirmed cyberattack to deliberately cause an electrical power grid blackout. Russian military GRU hackers infiltrated power distribution companies, hijacked SCADA human-machine interfaces (HMI), opened circuit breakers at 30 substations, and destroyed control systems with KillDisk.

Infiltration Vector: Spearphishing campaign delivering weaponized Microsoft Office documents containing BlackEnergy 3 macro malware targeting corporate networks of Ukrainian regional electricity distribution companies (Oblenergos).
3 techniques mapped · Loss: $50.0 million View full case dossier →

ATT&CK Techniques Cited in Advisory Matters

T1485: Data Destruction

"The conspirators deployed the NotPetya malware, designed to irreversibly encrypt and destroy victim computer records worldwide while masquerading as ransomware."

T1190: Exploit Public-Facing Application

"Conspirators compromised the software update mechanism of M.E.Doc, an accounting software used extensively in Ukraine, to distribute the malicious NotPetya binary."

T1021.002: SMB / Windows Admin Shares

"NotPetya leveraged EternalBlue (MS17-010) over SMB and PsExec to rapidly propagate across internal network subnets without user intervention."

T1003: OS Credential Dumping

"The malware harvested passwords from computer memory using a bundled Mimikatz variant to impersonate network administrators."

T1566.001: Spearphishing Attachment

"Spearphishing emails containing weaponized Microsoft Word documents executing malicious macros were sent to Ukrainian electrical substation operators."

T1055.012: Process Hollowing

"Olympic Destroyer hollowed out the legitimate svchost.exe process to inject malicious wiper threads while mimicking regular operating system background activity."