Loading story…
Researchers detailed how Black Energy 2 evolved into a modular botnet malware platform used to launch distributed denial-of-service attacks while supporting broader criminal operations. The malware used a layered design with a protective wrapper, decryptor and infector drivers, and a DLL injected into svchost.exe, allowing infected systems to contact command-and-control servers and load additional capabilities on demand.
The report said Black Energy 2 stored encrypted XML configuration data and used RC4 to protect communications, while downloadable plug-ins such as ddos, syn, and http enabled multiple attack methods. Beyond flooding targets, the malware also supported remote command execution, updates, and HTTP requests, giving operators a flexible framework for functions including spam distribution, credential theft, and proxy services, and helping cybercriminals assemble large botnets used in successful DDoS campaigns.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Malware writers significantly modified the original Black Energy in mid-2008, creating Black Energy 2. The newer version was designed as a more advanced and extensible botnet malware platform used primarily for DDoS attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BlackEnergy operators targeted Ukrainian media organizations and electric power companies with spearphishing emails carrying malicious Microsoft Word documents that used macros to install **BlackEnergy v3**. One lure referenced Ukraine’s Right Sector party and was likely used against the television channel **STB**. The malware dropped an executable, installed a DLL payload as `FONTCACHE.DAT`, created persistence through a startup `.LNK` file, and communicated with a hardcoded command-and-control server over HTTP, reflecting a broader campaign against Ukrainian government, media, energy, and other critical sectors. Investigators also found the group using BlackEnergy as a backdoor to deploy the destructive **KillDisk** component and a trojanized **Dropbear SSH** service known as **SSHBearDoor** for persistent remote access. KillDisk variants were customized by target type: media-focused samples overwrote files and rendered systems unbootable, while energy-sector variants also targeted processes tied to industrial control environments, indicating an intent to disrupt operations as well as destroy data. The activity showed an escalation from espionage and foothold establishment to destructive attacks against Ukrainian critical infrastructure.
Aug 15, 2026
ESET reported that the **BlackEnergy** malware family was used in targeted intrusions against organizations in **Ukraine and Poland**, linking the activity to a broader campaign focused on compromising selected victims in the region. The reporting described BlackEnergy as an established threat platform adapted for espionage and follow-on malicious activity, with attackers using it to gain footholds inside targeted networks. The campaign highlighted BlackEnergy’s continued evolution from earlier criminal use into a tool deployed in politically sensitive operations. The incidents underscored the risk to regional government and private-sector entities, showing that attackers were leveraging a known malware framework in focused attacks rather than indiscriminate mass infections.
Jun 29, 2026
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026