Loading malware…
BlackEnergy is a highly modular Windows malware family used in espionage and destructive campaigns, including operations associated with Sandworm Team, a Russian military intelligence threat group. Its industrial-control-system campaigns have operated since at least 2011, compromising Internet-connected human-machine interfaces and targeting critical infrastructure, notably Ukraine’s electricity sector.
BlackEnergy’s functionality varies by deployment. Documented plug-ins steal credentials saved in Firefox, Google Chrome, and Internet Explorer, record keystrokes, and capture screenshots. It also enumerates running processes, network configuration, and routing information. Modules search network-connected file shares and removable media to facilitate lateral movement. BlackEnergy injects a DLL component into a Windows service-host process and attempts to bypass default User Account Control settings on Windows 7 and later. BlackEnergy 3 establishes persistence through a startup-folder shortcut to its main DLL component.
Delivery has included exploitation of CVE-2014-0751 in Internet-facing GE Cimplicity HMI systems, exploitation of CVE-2014-4114 in other campaigns, malicious Microsoft Word spearphishing attachments, and infected executables on removable media. Compromised industrial environments have also included Advantech/BroadWin WebAccess installations.
Sandworm has used the associated KillDisk component to overwrite files on Windows-based HMIs and corrupt master boot records, rendering infected computers inoperable. BlackEnergy 3 was present in systems associated with Ukraine’s December 2015 power outage, but its presence does not establish that BlackEnergy itself directly operated electrical equipment or caused the outage.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Analysis of victim system artifacts has determined that the actors have been exploiting a vulnerability in GE’s Cimplicity HMI product since at least January 2012. The vulnerability, CVE-2014-0751, was published in ICS-CERT advisory ICSA-14-023-01 on January 23, 2014.
Public reports reference a BlackEnergy-based campaign against a variety of overseas targets leveraging vulnerability CVE-2014-4114 (affecting Microsoft Windows and Windows Server 2008 and 2012). ICS-CERT has not observed the use of this vulnerability to target control system environments.
Spear-phishing, documents with exploits (RTF CVE-2014-1761, PPTS CVE-2014-4114, …) | Like BlackEnergy (a.k.a. Sandworm, Quedagh), Potao is an example of targeted espionage (APT) malware detected mostly in Ukraine and a number of other CIS countries.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Sandworm Team has used the BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces.
the code implementing this algorithm included a subtle error, a mistake that was identical to exhibited by code used in the BlackEnergy attacks against Ukraine and elsewhere.
the code implementing this algorithm included a subtle error, a mistake that was identical to exhibited by code used in the BlackEnergy attacks against Ukraine and elsewhere.
For example, the group has been observed using custom-developed backdoors, such as “Pterodo” and “BlackEnergy”, to gain access to target systems and to maintain persistence within a network.
DOJ’s 2020 GRU Unit 74455 indictment describes destructive malware operations against Ukraine’s power grid, Ministry of Finance, and State Treasury Service, including BlackEnergy, Industroyer, and KillDisk, as part of a wider destabilization campaign.
"The malware, known as BlackEnergy, appears to have been used in cyberattacks against Georgia during the Russo-Georgian conflict of 2008 too, but has also been operated by criminals as a means to steal credit card data."
26 distinct techniques documented for this family, organized by ATT&CK tactic.
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
165 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware referenced as having been used to breach Ukrainian utilities in an attack that disrupted electric power.
Named malware family associated in the text with Sandworm's early activity labeling.
Malware used in destructive operations against Ukrainian state and power-sector targets as part of Russia’s wider destabilization campaign.
Referenced as an example of malware that evolved from DDoS-oriented use into targeted attacks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.