Loading malware…
BlackEnergy is a modular Windows malware family historically associated with Russian state activity, most notably Sandworm, and is closely linked to disruptive and destructive operations against Ukrainian critical infrastructure. Originally known as a crimeware toolkit, it evolved into a flexible platform used for intrusion, persistence, reconnaissance, credential collection, and command-and-control in enterprise and operational technology environments. BlackEnergy played a central role in the December 2015 compromise of Ukrainian electric utilities, where attackers used it within a broader intrusion that included phishing-led initial access, credential theft, remote access into utility networks, and hands-on-keyboard operations that contributed to power outages affecting hundreds of thousands of customers. The malware has also been referenced in destructive campaigns against Ukrainian government entities and critical infrastructure alongside KillDisk and later Sandworm tooling.
BlackEnergy supports a plugin-based architecture that enables operators to tailor functionality to victim environments. Documented capabilities include host reconnaissance through WMI, collection of detailed information about attached USB devices, theft of credentials from web browsers and locally stored application credential sources, and persistence through creation of Windows services. It communicates with command-and-control infrastructure over HTTP, including use of HTTP POST requests. Some variants also incorporated defense-evasion measures, including modification of system artifacts to conceal test-signing related changes.
The family has been used against sectors of high strategic value, especially energy and other critical infrastructure, and has been associated with intrusions that bridged traditional IT compromise and OT impact. BlackEnergy is widely recognized as one of the landmark malware families in the evolution of cyber-physical attacks on electric power systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Analysis of victim system artifacts has determined that the actors have been exploiting a vulnerability in GE’s Cimplicity HMI product since at least January 2012. The vulnerability, CVE-2014-0751, was published in ICS‑CERT advisory ICSA-14-023-01 on January 23, 2014.
...a BlackEnergy-based campaign against a variety of overseas targets leveraging vulnerability CVE-2014-4114 (affecting Microsoft Windows and Windows Server 2008 and 2012). ICS-CERT has not observed the use of this vulnerability to target control system environments.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For example, the group has been observed using custom-developed backdoors, such as “Pterodo” and “BlackEnergy”, to gain access to target systems and to maintain persistence within a network.
DOJ’s 2020 GRU Unit 74455 indictment describes destructive malware operations against Ukraine’s power grid, Ministry of Finance, and State Treasury Service, including BlackEnergy, Industroyer, and KillDisk, as part of a wider destabilization campaign.
DOJ’s 2020 GRU Unit 74455 indictment describes destructive malware operations against Ukraine’s power grid, Ministry of Finance, and State Treasury Service, including BlackEnergy, Industroyer, and KillDisk, as part of a wider destabilization campaign.
This group has been behind several cyber-attacks aimed at Ukraine in the past, such as the NotPetya ransomware outbreak, and the BlackEnergy attacks on Ukraine's power grid in 2015 and 2016.
"The malware, known as BlackEnergy, appears to have been used in cyberattacks against Georgia during the Russo-Georgian conflict of 2008 too, but has also been operated by criminals as a means to steal credit card data."
30 distinct techniques documented for this family, organized by ATT&CK tactic.
the defendants and their co-conspirators deployed destructive malware and took other disruptive actions, for the strategic benefit of Russia, through unauthorized access to victim computers (hacking).
The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'
the defendants and their co-conspirators deployed destructive malware and took other disruptive actions, for the strategic benefit of Russia, through unauthorized access to victim computers (hacking).
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.
The malware can infect a system by exploiting a standard feature in Windows that elevates the user privilege of a system file, allowing execution of the command executable with administrative privilege—even if the user is not a member of the administrator group.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.
The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.
AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine. Agent Tesla has the ability to extract credentials from configuration or support files. APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe.
The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
BlackEnergy has the capability to communicate over a backup channel via plus.google.com.
According to the indictment, beginning in or around November 2015 and continuing until at least in or around October 2019, the defendants and their co-conspirators deployed destructive malware and took other disruptive actions ... Their computer attacks used some of the world’s most destructive malware to date, including: KillDisk and Industroyer ... NotPetya ... and Olympic Destroyer
According to a study by Arbor Networks titled “Politically Motivated Distributed Denial of Service Attacks,” the pro-Kremlin youth group Nashi was allegedly involved in a DDoS attack against Estonia... The study also found that during the brief Russo-Georgian war, a DDoS attack was launched in sync with Russian tanks from various BlackEnergy-based botnets.
116 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware referenced as having been used to breach Ukrainian utilities in an attack that disrupted electric power.
Named malware family associated in the text with Sandworm's early activity labeling.
Malware used in destructive operations against Ukrainian state and power-sector targets as part of Russia’s wider destabilization campaign.
Used in the Ukraine 2015 intrusion chain for initial compromise and credential theft leading to VPN access into SCADA environments and subsequent hands-on-keyboard operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.