BlackEnergyMalware
- Black Energy
BlackEnergy, its first version shortened as BE1, started as a crimeware being sold in the Russian cyber underground as early as 2007. Initially, it was designed as a toolkit for creating botnets for conducting DDoS attacks. It supported a variety of flooding commands including protocols like ICMP, TCP SYN, UDP, HTTP and DNS.From MISP Galaxy
Last reported 4 months ago, by ESET WeLiveSecurity (ES)10 reports
ATT&CK techniques
6 of 21 · each with the sentence it comes from- T1053.005Scheduled Task
“Restrict Scheduled Tasks: viserion_, rhaegal, drogon”
- T1003OS Credential Dumping
“OS Credential Dumping: LSASS Memory”
- T1003.001LSASS Memory
“T1003.001”
- T1036Masquerading
“Masquerading as Russian hackers”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
10 reports, newest first · the exact sentence from each-
Proteger sistemas industriales desactualizados frente a las ciberamenazas modernas“…s, su equipo de investigación de amenazas ha analizado algunos de los incidentes más relevantes registrados, incluyendo BlackEnergy, que provocó un corte de energía de entre 4 y 6 horas para 230.000 personas en Ucrania en 2015; su sucesor GreyEnergy, e…”
-
Protecting legacy OT systems against modern cyberthreats“Over the years, its threat research team has peered inside some of the most significant incidents on record – including BlackEnergy that triggered a 4–6 hour power outage for 230,000 people in Ukraine in 2015, its successor, GreyEnergy, and Industroyer, the highly customizable ma…”
-
DynoWiper update: Technical analysis and attribution“Typically, these operations have been conducted covertly for cyberespionage purposes, as seen in the BlackEnergy and GreyEnergy cases.”
-
ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025“Back in December 2015, Sandworm used the BlackEnergy malware to gain access to critical systems at several electrical substations, leaving around 230,000 people without electricity for several hours.”
-
NotPetya pulls BadRabbit out of the hat“This corresponds with BlackEnergy timeframes, as the group started its notable activity in 2014 with disk tools.”
-
BadRabbit: spread of new cryptolocker“These similarities suggest a link between Bad Rabbit and Black Energy campaigns.”
-
Targeted attacks on banks“Last year, a similar scenario was used by the Black Energy group to attack the Boryspil International Airport in Kiev and Ukrainian power grids.”
-
Petya starts with Ukraine and then goes global“A preliminary investigation showed that the pro-state Black Energy group that had previously attacked energy and financial organizations in Ukraine was behind the attack.”
-
LAZARUS ARISEN“In late 2016, attacks on Ukrainian banks were conducted, allegedly as part of the BlackEnergy operation.”
-
In a Risk Group“For example, tools developed by the BlackEnergy group that once knocked out the power in several districts of Ukraine allow remote control of Remote terminal units (RTU) responsible for physical opening/closing of power grids.”
Indicators in its reports
named in the reports above- 4ec3c90846af6b79…3fd21f6d4cf6in 2 reports
- 185.149.120[.]3in 2 reports
- 1dnscontrol[.]comin 2 reports
- www.fontanka[.]ruin 2 reports
- hxxp://argumenti[.]ruin 2 reports
- argumenti[.]ruin 2 reports
- hxxp://argumentiru[.]comin 2 reports
- argumentiru[.]comin 2 reports
- fbbdc39af1139aebba4da004475e8839in 2 reports
- webcheck01[.]netin 2 reports
- webdefense1[.]netin 2 reports
- secure-check[.]hostin 2 reports
- firewebmail[.]comin 2 reports
- secureinbox[.]emailin 2 reports
- secure-dns1[.]netin 2 reports
- 31.172.71[.]5in 1 report
- progamevl[.]ruin 1 report
- 472ca448f82a7ff6…86fd7c38b631in 1 report
- 4f8e9336a784a196…8fa54f6a92e2in 1 report
- 86596a5c5b05a8bf…4702f7d0d61bin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.