ATT&CK® Evaluations to Emulate Tactics, Techniques of Sandworm and Wizard Spider Groups
MITRE Engenuity will assess commercial cybersecurity products’ ability to detect the threat posed by the groups commonly known as Sandworm and Wizard Spider, both of whom have used data encryption as a key element of their attacks. Applications for evaluation are available through May 28.
Analysts believe that Sandworm used data encryption to incur more than $10 billion in damage to industry in attacks with its NotPetya malware. The group is also widely suspected of attacks that have shut down the Ukrainian electrical grid on multiple occasions. Wizard Spider has reportedly used data encryption to steal more than $150 million through ransomware attacks.
The evaluations will use ATT&CK®, a MITRE-curated knowledge base of adversary tactics, techniques, and procedures that is based on published threat reporting. ATT&CK is freely available and is used by cyber defenders in areas including finance, healthcare, energy, manufacturing, retail, and government to understand adversary behavior and tradecraft.
MITRE Engenuity will evaluate each participating vendor’s ability to detect the threats posed by Sandworm and Wizard Spider in two distinct scenarios during the evaluation. All results will be released, and the format will allow the public to see them in their entirety or filtered by adversary.
“Sandworm and Wizard Spider use a range of strategies and tactics that are typical of a broad range of adversaries that employ data encryption to achieve their goals,” said Frank Duff, ATT&CK Evaluations lead.
“We’re increasingly receiving requests to address high-impact techniques like data encryption, which can devastate healthcare organizations, municipal governments, and a wide range of other critical infrastructure,” Duff said. “However, these emulated scenarios will still include the full range of tactics and techniques that these groups use as they penetrate and operate on networks prior to encrypting data.”
MITRE Engenuity plans to announce results shortly from its evaluations based on Carbanak and FIN7, groups that analysts believe have stolen more than $1 billion across hundreds of businesses in the financial services and hospitality industries over the past five years.
Earlier ATT&CK evaluations examined the threat posed by APT3, a Chinese-based threat group that analysts believe has targeted U.S. organizations and Hong Kong-based political targets, and APT29, a group attributed to the Russian government and the compromise of the Democratic National Committee that started in 2015.
Cybersecurity vendors may apply for an evaluation via evals@mitre-engenuity.org. The evaluations are paid for by vendors and are intended to help vendors and end users better understand their product’s capabilities in relation to the ATT&CK framework. MITRE Engenuity makes the methodology and resulting data publicly available so other organizations may benefit and conduct their own analysis and interpretation. The evaluations do not provide scores, ranks, or endorsements. Results will be announced in early 2022.
Vendors can sign up for an optional extension to their detection evaluation that will exercise their ability to protect against specific adversary techniques utilized by these groups.
