Loading malware…
BlackEnergy2 is an industrial-control-system-relevant malware family associated with the Sandworm-linked activity cluster tracked by Dragos as KAMACITE. It is historically significant as one of the early known ICS-specific malware families and is tied to operations against critical infrastructure, particularly the Ukrainian power sector. KAMACITE is assessed to have facilitated OT-specific operations using BlackEnergy2 and to have supported the campaigns connected to the 2015 and 2016 Ukraine electric power events. BlackEnergy2 is therefore notable less as a generic commodity threat and more as part of a broader intrusion and disruption ecosystem used against industrial environments.
Available high-confidence reporting in this context supports BlackEnergy2’s role in ICS-targeted operations and its association with critical-infrastructure intrusion activity, but does not provide sufficient direct detail here to characterize its precise malware class, delivery vector, or platform-specific execution with confidence. Its operational relevance is in enabling post-compromise activity within industrial environments and supporting campaigns aimed at electric utilities and other critical infrastructure sectors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
2014 年 8 月 13 日左右,沙虫APT组织通过包含 0day 漏洞(CVE-2014-4114)的PowerPoint文件,结合BlackEnergy2/3恶意木马实施攻击
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Dragos has determined that KAMACITE has facilitated ICS-specific operations leveraging its BLACKENERGY2 malware.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
BlackEnergy2 spreads mainly through targeted phishing attacks by e-mail containing the malware installer. ... BlackEnergy 3 Malware Installation Cybercriminal groups perform e-mail phishing attacks containing Microsoft Office files (Excel, Word, PowerPoint, etc.) with malicious VBA macros to infected target systems.
The following command, executed by the installer, copies the driver component to the Windows driver folder and starts its Windows service: /c "ping localhost -n 8 & move /Y ..." ... After that, the installer will exit by running the following command: /s /c "for /L %i in (1,1,100) do ( del /F ... )"
Once installed and running, the executable file behind the hidden device driver will inject code to %WINDIR%\system32\svchost.exe process and start the backdoor... FONTCACHE.DAT will inject code to %WINDIR%\system32\svchost.exe process which will instantiate iexplorer.exe instances from time to time.
Once installed and running, the executable file behind the hidden device driver will inject code to %WINDIR%\system32\svchost.exe process and start the backdoor... FONTCACHE.DAT will inject code to %WINDIR%\system32\svchost.exe process which will instantiate iexplorer.exe instances from time to time.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as prior ICS-specific malware in the historical set used for comparison; no additional details provided in this content.
Malware associated with OT-specific operations and the Ukraine power event activity chain.
ICS-capable malware used in KAMACITE-facilitated operations; one of the BLACKENERGY family variants with built-in ICS capability.
Mentioned as historical precedent in the list of known ICS-specific malware families.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.