Loading malware…
BlackEnergy is a modular malware family and crimeware toolkit first described as emerging in 2007. It evolved into later variants including BlackEnergy 2 and BlackEnergy 3, and has been associated with Sandworm, also tracked as GRU Unit 74455, APT44, IRIDIUM, Voodoo Bear, TeleBots, and related BlackEnergy-era activity. The malware is directly linked in the provided content to destructive operations against Ukraine, including the 2015 Ukraine electric power attack and broader campaigns from December 2015 through December 2016 against Ukraine’s power grid, Ministry of Finance, and State Treasury Service, often alongside KillDisk and later Industroyer. In the 2015 power attack, BlackEnergy was used after spearphishing and credential theft to support access into the victim environment, including communication between compromised hosts and command-and-control servers via HTTP POST requests, while operators conducted hands-on-keyboard actions against SCADA systems and a telephone denial-of-service targeted the call center. The content also states BlackEnergy targeted specific vendor HMI products and that organizations with HMI systems directly connected to the Internet were especially susceptible.
Capabilities explicitly described in the content include modular plug-ins for host and credential collection, persistence, and defense evasion. BlackEnergy can gather detailed information about attached USB devices, including device instance ID and drive geometry. A BlackEnergy 2 plug-in uses WMI to gather victim host details. Other plug-ins can collect credentials stored in files on the host from The Bat! email client, Outlook, and Windows Credential Store, and can gather credentials from web browsers including Firefox, Google Chrome, and Internet Explorer. One variant creates a new Windows service using either a hard-coded or randomly generated name for persistence. For defense evasion, BlackEnergy has removed the watermark associated with enabling TESTSIGNING by removing relevant strings from user32.dll.mui.
Initial infection vectors described in the content include social engineering, especially malicious emails or document attachments that drop a trojanized component or infected legitimate executable. The content also ties BlackEnergy-derived activity to broader critical infrastructure and OT targeting, especially in Ukraine’s energy sector, and notes its role in the first publicly recognized blackout caused by a cyberattack in 2015. Additional historical reporting in the content links BlackEnergy-based botnets to DDoS activity during the Russo-Georgian war. Overall, the provided material characterizes BlackEnergy as a significant malware family used in espionage, access, and destructive critical-infrastructure operations, particularly by Sandworm against Ukrainian targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Analysis of victim system artifacts has determined that the actors have been exploiting a vulnerability in GE’s Cimplicity HMI product since at least January 2012. The vulnerability, CVE-2014-0751, was published in ICS‑CERT advisory ICSA-14-023-01 on January 23, 2014.
...a BlackEnergy-based campaign against a variety of overseas targets leveraging vulnerability CVE-2014-4114 (affecting Microsoft Windows and Windows Server 2008 and 2012). ICS-CERT has not observed the use of this vulnerability to target control system environments.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For example, the group has been observed using custom-developed backdoors, such as “Pterodo” and “BlackEnergy”, to gain access to target systems and to maintain persistence within a network.
DOJ’s 2020 GRU Unit 74455 indictment describes destructive malware operations against Ukraine’s power grid, Ministry of Finance, and State Treasury Service, including BlackEnergy, Industroyer, and KillDisk, as part of a wider destabilization campaign.
DOJ’s 2020 GRU Unit 74455 indictment describes destructive malware operations against Ukraine’s power grid, Ministry of Finance, and State Treasury Service, including BlackEnergy, Industroyer, and KillDisk, as part of a wider destabilization campaign.
This group has been behind several cyber-attacks aimed at Ukraine in the past, such as the NotPetya ransomware outbreak, and the BlackEnergy attacks on Ukraine's power grid in 2015 and 2016.
"The malware, known as BlackEnergy, appears to have been used in cyberattacks against Georgia during the Russo-Georgian conflict of 2008 too, but has also been operated by criminals as a means to steal credit card data."
30 distinct techniques documented for this family, organized by ATT&CK tactic.
the defendants and their co-conspirators deployed destructive malware and took other disruptive actions, for the strategic benefit of Russia, through unauthorized access to victim computers (hacking).
The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'
the defendants and their co-conspirators deployed destructive malware and took other disruptive actions, for the strategic benefit of Russia, through unauthorized access to victim computers (hacking).
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.
The malware can infect a system by exploiting a standard feature in Windows that elevates the user privilege of a system file, allowing execution of the command executable with administrative privilege—even if the user is not a member of the administrator group.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.
The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.
AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine. Agent Tesla has the ability to extract credentials from configuration or support files. APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe.
The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
BlackEnergy has the capability to communicate over a backup channel via plus.google.com.
According to the indictment, beginning in or around November 2015 and continuing until at least in or around October 2019, the defendants and their co-conspirators deployed destructive malware and took other disruptive actions ... Their computer attacks used some of the world’s most destructive malware to date, including: KillDisk and Industroyer ... NotPetya ... and Olympic Destroyer
According to a study by Arbor Networks titled “Politically Motivated Distributed Denial of Service Attacks,” the pro-Kremlin youth group Nashi was allegedly involved in a DDoS attack against Estonia... The study also found that during the brief Russo-Georgian war, a DDoS attack was launched in sync with Russian tanks from various BlackEnergy-based botnets.
113 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malware family associated in the text with Sandworm's early activity labeling.
Malware used in destructive operations against Ukrainian state and power-sector targets as part of Russia’s wider destabilization campaign.
Used in the Ukraine 2015 intrusion chain for initial compromise and credential theft leading to VPN access into SCADA environments and subsequent hands-on-keyboard operations.
Malware associated in the content with the 2015 Ukraine power grid attack that caused a cyber-induced blackout.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.