MalwareUsed by 1 actor

GOGETTER

GOGETTER is malware used by Sandworm Team during the 2022 Ukraine Electric Power Attack. The provided content identifies it as tunneler software deployed to establish a Yamux TLS-based command-and-control channel with external servers and to proxy C2 communications through a TLS tunnel. On Linux systems, Sandworm configured systemd to maintain GOGETTER persistence, including setting service units with WantedBy=multi-user.target so it would run when the system began accepting user logins. The actor also leveraged systemd service units to masquerade GOGETTER as legitimate or seemingly legitimate services. High-confidence details in the content tie GOGETTER specifically to Sandworm Team activity in the 2022 Ukraine Electric Power Attack. No file hashes, filenames, or network indicators beyond the Yamux TLS-based C2 channel are provided in the source content.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Sandworm

During the 2022 Ukraine Electric Power Attack, Sandworm Team configured Systemd to maintain persistence of GOGETTER... deployed the GOGETTER tunneler software to establish a "Yamux" TLS-based C2 channel with an external server(s).

via mitre attackattack.mitre.org

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1543.002Systemd ServiceEvidence1

During the 2022 Ukraine Electric Power Attack, Sandworm Team configured Systemd to maintain persistence of GOGETTER, specifying the WantedBy=multi-user.target configuration to run GOGETTER when the system begins accepting user logins.

Privilege Escalation

1 technique

T1543.002Systemd ServiceEvidence1

Stealth

1 technique

T1036.004Masquerade Task or ServiceEvidence1

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Systemd service units to masquerade GOGETTER malware as legitimate or seemingly legitimate services.

Command and Control

1 technique

T1572Protocol TunnelingEvidence1

During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the GOGETTER tunneler software to establish a "Yamux" TLS-based C2 channel with an external server(s).

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

mitre attackNews

Jan 24, 2026

Masquerading: Masquerade Task or Service, Sub-technique T1036.004 - Enterprise | MITRE ATT&CK®

Malware observed in the 2022 Ukraine Electric Power Attack; it was disguised via systemd service units to appear as legitimate services.

mitre attackNews

Mar 18, 2026

2022 Ukraine Electric Power Attack, Campaign C0034 | MITRE ATT&CK®

A tunneling tool used to establish a TLS-based C2 channel (Yamux) and maintained via systemd persistence; also masqueraded as legitimate services.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

GOGETTER