GreyEnergyThreat actor
ESET research reveals a successor to the infamous BlackEnergy APT group targeting critical infrastructure, quite possibly in preparation for damaging attacksFrom MISP Galaxy
Last reported 4 months ago, by ESET WeLiveSecurity (ES)3 reports
ATT&CK techniques
6 of 18 · each with the sentence it comes from- T1003OS Credential Dumping
“OS Credential Dumping: LSASS Memory”
- T1003.001LSASS Memory
“T1003.001”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
- T1053.005Scheduled Task
“T1053.005”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
- T1059.001PowerShell
“T1059.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Proteger sistemas industriales desactualizados frente a las ciberamenazas modernas“…o BlackEnergy, que provocó un corte de energía de entre 4 y 6 horas para 230.000 personas en Ucrania en 2015; su sucesor GreyEnergy, e Industroyer, un malware altamente personalizable que utiliza varios protocolos de comunicación industrial empleados en siste…”
-
Protecting legacy OT systems against modern cyberthreats“…cidents on record – including BlackEnergy that triggered a 4–6 hour power outage for 230,000 people in Ukraine in 2015, its successor, GreyEnergy, and Industroyer, the highly customizable malware that speaks several industrial communication protocols used in critical infrastructu…”
-
DynoWiper update: Technical analysis and attribution“Typically, these operations have been conducted covertly for cyberespionage purposes, as seen in the BlackEnergy and GreyEnergy cases.”
Indicators in its reports
named in the reports above- 31.172.71[.]5in 1 report
- progamevl[.]ruin 1 report
- 472ca448f82a7ff6…86fd7c38b631in 1 report
- 4f8e9336a784a196…8fa54f6a92e2in 1 report
- 4ec3c90846af6b79…3fd21f6d4cf6in 1 report
- 86596a5c5b05a8bf…4702f7d0d61bin 1 report
- 69ede7e341fd26fa…80cb44778d93in 1 report
- 9ec4c38394ea2048…6de48d8bd4e8in 1 report
- 410c8a57fe6e09ed…e4797ca80a19in 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.