Loading malware…
BlackEnergy3 is a Windows-based malware family associated with Sandworm and best known for its role in intrusions against Ukrainian critical infrastructure, including the 2015 electric power disruption. It functioned as an access and post-compromise platform inside enterprise networks, enabling operators to establish footholds, conduct reconnaissance, steal credentials, move laterally, and pivot from IT environments into operational technology networks. In the Ukraine power-grid intrusion, BlackEnergy3 supported long-term access that allowed the adversary to reach SCADA environments and manually operate human-machine interface systems to open breakers at multiple substations. The malware has also been linked to deployment of destructive follow-on components such as KillDisk and to broader intrusion activity against industrial organizations. BlackEnergy3 is widely regarded as one of the early malware families used in operations that bridged conventional enterprise compromise and OT disruption, and it is often discussed alongside later Sandworm tooling such as GreyEnergy.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
2014 年 8 月 13 日左右,沙虫APT组织通过包含 0day 漏洞(CVE-2014-4114)的PowerPoint文件,结合BlackEnergy2/3恶意木马实施攻击 | 之后在乌克兰电网内部网络潜伏长达6个月至1年,通过植入的恶意软件 BlackEnergy3(黑色能量3),远程控制电力系统的SCADA节点...
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BLACKENERGY3 which served as the access tool to the IT networks that allowed the adversary to pivot to OT networks and orchestrate the 2015 cyber attack on Ukraine’s electric system.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
BlackEnergy2 spreads mainly through targeted phishing attacks by e-mail containing the malware installer. ... BlackEnergy 3 Malware Installation Cybercriminal groups perform e-mail phishing attacks containing Microsoft Office files (Excel, Word, PowerPoint, etc.) with malicious VBA macros to infected target systems.
vba_macro.exe作为下载器,将BlackEnergy恶意程序释放到目标主机并执行,同时与攻击者的命令与控制(C2)服务器建立连接。
The following command, executed by the installer, copies the driver component to the Windows driver folder and starts its Windows service: /c "ping localhost -n 8 & move /Y ..." ... After that, the installer will exit by running the following command: /s /c "for /L %i in (1,1,100) do ( del /F ... )"
Once installed and running, the executable file behind the hidden device driver will inject code to %WINDIR%\system32\svchost.exe process and start the backdoor... FONTCACHE.DAT will inject code to %WINDIR%\system32\svchost.exe process which will instantiate iexplorer.exe instances from time to time.
The VBA macro contains obfuscated malicious code stored as a set of arrays of values in decimal format... Both the malware dropper (vba_macro.exe) and core (FONTCACHE.DAT) are Portable Executable files with encrypted contents.
Once installed and running, the executable file behind the hidden device driver will inject code to %WINDIR%\system32\svchost.exe process and start the backdoor... FONTCACHE.DAT will inject code to %WINDIR%\system32\svchost.exe process which will instantiate iexplorer.exe instances from time to time.
BlackEnergy was originally designed to be an HTTP-based botnet... Commands are sent by the C2 server to the bot clients through HTTP POST requests with Base64 encoded data... Following is an example of a HTTP request sent from the malware to the C2.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
用于针对工业控制系统和电力基础设施的模块化后门/木马。文中称其通过钓鱼邮件投递，建立与C2服务器连接，在受害网络中长期潜伏，并被用于进入SCADA/ICS环境、远程控制节点、上传恶意固件及投递破坏性插件。
Referenced as historical OT-targeting malware in background discussion.
Referenced as the predecessor malware family to GREYENERGY.
An access tool used to compromise IT networks and pivot into OT networks in support of attacks on Ukraine's electric system.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.