Loading malware…
BlackEnergy3 is a Windows backdoor used to establish remote access to compromised networks, notably in Sandworm operations against Ukrainian electricity utilities. Sandworm is associated with Russia’s GRU unit 74455. BlackEnergy3 played an enabling role in the December 2015 Ukrainian power-grid attack by providing access to enterprise IT networks from which the attackers could pivot toward operational technology environments.
In the Ukrainian utility intrusions, spearphishing emails delivered malicious Microsoft Excel attachments containing macros. Enabling the macros executed a downloader that installed BlackEnergy3. The attackers maintained access for months before the disruptive operation, using additional tools and stolen credentials to reach control-system environments.
BlackEnergy3 was not an industrial-protocol-specific attack tool. The resulting power disruption involved attackers manually operating SCADA/HMI interfaces to open circuit breakers. The broader operation also employed the separate KillDisk destructive component, malicious device firmware, and telephone denial-of-service activity to impede recovery and outage reporting. These disruptive actions should be distinguished from BlackEnergy3’s network-access role. GREYENERGY is recognized as its successor.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
2014 年 8 月 13 日左右,沙虫APT组织通过包含 0day 漏洞(CVE-2014-4114)的PowerPoint文件,结合BlackEnergy2/3恶意木马实施攻击 | 之后在乌克兰电网内部网络潜伏长达6个月至1年,通过植入的恶意软件 BlackEnergy3(黑色能量3),远程控制电力系统的SCADA节点...
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
While BlackEnergy3 is not “industrial-specific” in the same sense as either Industroyer variant or other items such as Triton, it did serve a critical enabling function as part of the overall attack sequence leading up to power disruption.
BLACKENERGY3 which served as the access tool to the IT networks that allowed the adversary to pivot to OT networks and orchestrate the 2015 cyber attack on Ukraine’s electric system.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
BlackEnergy2 spreads mainly through targeted phishing attacks by e-mail containing the malware installer. ... BlackEnergy 3 Malware Installation Cybercriminal groups perform e-mail phishing attacks containing Microsoft Office files (Excel, Word, PowerPoint, etc.) with malicious VBA macros to infected target systems.
vba_macro.exe作为下载器,将BlackEnergy恶意程序释放到目标主机并执行,同时与攻击者的命令与控制(C2)服务器建立连接。
The following command, executed by the installer, copies the driver component to the Windows driver folder and starts its Windows service: /c "ping localhost -n 8 & move /Y ..." ... After that, the installer will exit by running the following command: /s /c "for /L %i in (1,1,100) do ( del /F ... )"
Once installed and running, the executable file behind the hidden device driver will inject code to %WINDIR%\system32\svchost.exe process and start the backdoor... FONTCACHE.DAT will inject code to %WINDIR%\system32\svchost.exe process which will instantiate iexplorer.exe instances from time to time.
The VBA macro contains obfuscated malicious code stored as a set of arrays of values in decimal format... Both the malware dropper (vba_macro.exe) and core (FONTCACHE.DAT) are Portable Executable files with encrypted contents.
Once installed and running, the executable file behind the hidden device driver will inject code to %WINDIR%\system32\svchost.exe process and start the backdoor... FONTCACHE.DAT will inject code to %WINDIR%\system32\svchost.exe process which will instantiate iexplorer.exe instances from time to time.
BlackEnergy was originally designed to be an HTTP-based botnet... Commands are sent by the C2 server to the bot clients through HTTP POST requests with Base64 encoded data... Following is an example of a HTTP request sent from the malware to the C2.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
用于针对工业控制系统和电力基础设施的模块化后门/木马。文中称其通过钓鱼邮件投递，建立与C2服务器连接，在受害网络中长期潜伏，并被用于进入SCADA/ICS环境、远程控制节点、上传恶意固件及投递破坏性插件。
Referenced as historical OT-targeting malware in background discussion.
Malware that enabled the attack sequence preceding Ukraine's 2015 electricity disruption. The article connects it to Industroyer2 through reuse of the process name PService_PPD.exe and attribution of both malware families to Sandworm. It does not establish whether the reused name reflects an operational-security mistake or deliberate signaling.
Referenced as the predecessor malware family to GREYENERGY.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.