Loading malware…
GreyEnergy is a modular Windows backdoor used for espionage and persistent access to critical infrastructure networks. A successor to BlackEnergy3, it has been associated with Sandworm-linked operations and activity tracked by Dragos as KAMACITE. Its targets include energy providers, transportation organizations, and industrial enterprises, particularly in Ukraine and other Central and Eastern European countries. Campaigns have also targeted industrial organizations in Kazakhstan.
Infection chains use spearphishing documents and compromised public-facing web servers. Malicious documents have exploited CVE-2017-0199 and CVE-2017-11882 to retrieve subsequent payloads. The lightweight GreyEnergy Mini backdoor serves as an initial stage, collecting and exfiltrating host, account, operating-system, network, and security-software information before deployment of the main payload.
GreyEnergy can download additional modules and payloads, capture keystrokes and screenshots, collect system information and event logs, harvest saved passwords, and dump Windows credentials through a Mimikatz module. It supports portable executable injection into remote processes and enumerates Windows services. The main payload can operate entirely in memory or establish persistence by configuring a Windows service to load a malicious DLL. It uses PsExec locally to launch the Windows Rundll32 utility with SYSTEM privileges.
Command-and-control communications use HTTP and HTTPS, with AES-256 and RSA-2048 encryption. GreyEnergy has used Tor relays and internal proxy chains to conceal external command-and-control infrastructure. Its evasion mechanisms include encrypted configuration data and strings, custom packing, dynamic Windows API resolution, anti-analysis code, memory wiping, and secure file deletion. Digitally signed samples have also been observed. GreyEnergy droppers continued to evolve, with new variants identified in March and August 2021.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Like its predecessor, GreyEnergy malware has been detected attacking industrial and ICS targets, mainly in Ukraine.
In 2021, Dragos uncovered two new GREYENERGY dropper variants in the wild: one in March of 2021, and another in August 2021.
GreyEnergy and its accompanying toolset was typically prefaced with a phishing attack, containing malicious documents that would deploy “GreyEnergy mini”, a first-stage backdoor.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
A second point of entry was via vulnerable public-facing web services that are connected to the organization’s internal network.
The attack on the Ukrainian power grid was prefaced with a phishing attack against a number of energy distribution companies. The phishing email contained a Word document that, when Macros were enabled, dropped the Black Energy malware to disk.
This same C2 server was also used in a spearphishing email attachment sent by GreyEnergy (aka FELIXROOT)... Another server we detected that was used both by Zebrocy and by GreyEnergy is 185.217.0[.]124. Similarly, we detected a spearphishing GreyEnergy document...
When a Web server is hosted internally and connected to the rest of an organization's network, the attackers have typically used that to try and move laterally on the network and plant backup backdoors so they can reinfect a victim network if their malware is spotted and removed.
The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
The file ... with the name “Seminar.rtf” exploited CVE-2017-0199 ... “Seminar.rtf” downloaded a second stage document ... (4de5adb865b5198b4f2593ad436fceff, exploiting CVE-2017-11882) ... we detected a spearphishing GreyEnergy document ... exploiting CVE-2017-11882
GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.
They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.
On other systems, attackers have been using a relatively obscure Windows registry key feature to install and disguise the GreyEnergy malware so it is capable of surviving system reboots.
On other systems, attackers have been using a relatively obscure Windows registry key feature to install and disguise the GreyEnergy malware so it is capable of surviving system reboots.
GreyEnergy has a module to inject a PE binary into a remote process.
GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.
On other systems, attackers have been using a relatively obscure Windows registry key feature to install and disguise the GreyEnergy malware so it is capable of surviving system reboots.
On other systems, attackers have been using a relatively obscure Windows registry key feature to install and disguise the GreyEnergy malware so it is capable of surviving system reboots.
The GreyEnergy dropper is protected using a custom packer with the following characteristics: Custom decryption algorithm LZW (variant) decompression algorithm Junk code & JMP instructions (anti-analysis)
The GreyEnergy dropper is protected using a custom packer with the following characteristics: Custom decryption algorithm LZW (variant) decompression algorithm Junk code & JMP instructions (anti-analysis) Memory wiping (anti-forensic) Dynamically-resolved WinAPIs Overlay data payload
The GreyEnergy dropper is protected using a custom packer with the following characteristics: ... Dynamically-resolved WinAPIs
GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.
GreyEnergy has a module to inject a PE binary into a remote process.
The GreyEnergy dropper is protected using a custom packer with the following characteristics: ... Memory wiping (anti-forensic)
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.
They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
GreyEnergy's main module can run either in memory only... The malware is installed so when the attackers are done, the malicious DLL file that is used to infect the system is securely wiped from disk, and the payload exists only in the memory of the Windows service that is hosting it.
ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
GreyEnergy digitally signs the malware with a code-signing certificate.
NotPetya ransomware caused worldwide damages due to its highly effective spreading mechanism combining the EternalBlue (MS17-010) vulnerability, credential dumping from infected systems and PsExec for lateral movement.
GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.
The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.
The modules that ESET has observed so far include those for collecting system information, event logs, malware hashes, file system operations, screen shots, keystroke logs, saved passwords, and user credentials using the Mimikatz tool.
GreyEnergy enumerates all Windows services.
The attacker’s toolset also contained Nmap and Mimikatz for discovery and lateral movement.
Like several threat groups these days, GreyEnergy also has been using multiple legitimate tools, such as Mimikatz, PsExec, and Nmap, in its campaigns.
The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.
The modules that ESET has observed so far include those for collecting system information, event logs, malware hashes, file system operations, screen shots, keystroke logs, saved passwords, and user credentials using the Mimikatz tool.
Both sets of activity used the same servers at the same time and targeted the same organization... different Zebrocy C2 servers, including 193.23.181[.]151 ... Another server we detected that was used both by Zebrocy and by GreyEnergy is 185.217.0[.]124 ... They retrieve additional data from the following URL...
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
To disguise the source of malicious traffic, adversaries may chain together multiple proxies.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.
GreyEnergy encrypts communications using AES256.
GreyEnergy encrypts communications using RSA-2048.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
49 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.