{ "family": "blackenergy", "sample_count": 1, "category": "advanced_threat", "description": "BlackEnergy is an advanced, modular persistent threat (APT) framework originally authored in 2007 by Ukrainian hacker Dmytro Oleksiuk (alias 'Cr4sh') as an underground HTTP-based distributed denial-of-service (DDoS) botnet. Between 2010 and 2014, the codebase was heavily overhauled and co-opted by Russian state-sponsored threat actors—specifically the Russian General Staff Main Intelligence Directorate (GRU) Unit 74455 and Unit 26165, collectively tracked worldwide as Sandworm Team (TeleBots, Voodoo Bear).\n\nUnder Sandworm development, BlackEnergy 2 and BlackEnergy 3 evolved into a multi-tiered cyber espionage and industrial sabotaging platform. The framework utilized rootkit drivers, modular DLL payloads, and specialized industrial control system (ICS/SCADA) plugins targeting serial-to-ethernet converters and Human-Machine Interface (HMI) workstations. On December 23, 2015, Sandworm deployed BlackEnergy 3 alongside the destructive KillDisk wiper component against Ukraine's electricity distribution grid (Kyivoblenergo), severing power to approximately 230,000 citizens in the world's first publicly acknowledged electrical blackout triggered by a cyber weapon. BlackEnergy was subsequently highlighted in the October 2020 US Department of Justice indictment charging six GRU Unit 74455 officers with global cyber intrusions.", "cta": "Published by the SystemHelpdesk team.", "aliases": [ "BlackEnergy", "BlackEnergy 2", "BlackEnergy 3", "Sandworm Toolkit", "Win32/BlackEnergy", "Backdoor.BlackEnergy" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is BlackEnergy malware?", "acceptedAnswer": { "@type": "Answer", "text": "BlackEnergy is a sophisticated Russian state-sponsored cyber espionage and sabotage framework famous for its role in the historic December 2015 cyberattack on Ukraine's power grid." } }, { "@type": "Question", "name": "Who operates BlackEnergy?", "acceptedAnswer": { "@type": "Answer", "text": "Originally created as a DDoS tool in 2007 by Dmytro Oleksiuk, it was weaponized and operated by the Russian GRU Unit 74455 (Sandworm Team), who were federally indicted by the US DOJ in 2020." } }, { "@type": "Question", "name": "How was BlackEnergy used in the 2015 Ukraine electrical blackout?", "acceptedAnswer": { "@type": "Answer", "text": "Sandworm deployed BlackEnergy 3 to compromise regional electricity distribution workstations, sever power substations remotely, and execute the KillDisk wiper to destroy master boot records and hinder recovery." } }, { "@type": "Question", "name": "What vulnerability did BlackEnergy exploit for initial access?", "acceptedAnswer": { "@type": "Answer", "text": "BlackEnergy campaigns extensively exploited CVE-2014-4114 (the 'Sandworm' vulnerability), a remote code execution flaw in Microsoft Windows OLE package handling." } }, { "@type": "Question", "name": "How can industrial networks defend against BlackEnergy-style intrusions?", "acceptedAnswer": { "@type": "Answer", "text": "Enforce strict network segmentation between IT and OT/SCADA environments, require multi-factor authentication on all remote VPN access, and deploy endpoint application whitelisting on HMI stations." } } ], "faq_count": 5, "mitre_attack": [ "T1055", "T1059.003", "T1562.001", "T1485", "T1071.001", "T1082" ], "cisa_advisory": null, "last_updated": "2026-07-01T17:16:56Z", "type": "APT / ICS Trojan", "target_industries": [ "Global / Opportunistic" ], "motivation": "Opportunistic", "threat_actors": [ "Unknown / Cybercriminal" ], "target_geographies": [ "Global" ], "attack_stage": [ "execution", "persistence" ], "ecosystem": [ "windows_pe" ], "is_emerging": false, "first_seen": 2007, "lineage": { "derived_from": [], "variants": [ "blackenergy v1 (ddos)", "blackenergy v2 (rootkit)", "blackenergy v3 (ics/scada)", "killdisk wiper module" ] }, "attribution": [ { "actor": "Russian GRU Unit 74455 (Sandworm Team / TeleBots) / Dmytro Oleksiuk (Cr4sh)", "confidence": "high", "basis": "US Department of Justice October 2020 federal indictment of six GRU military officers for Sandworm cyberattacks, corroborated by US CISA, FBI, and Ukrainian CERT (CERT-UA) alerts identifying BlackEnergy in the 2015 Ukrainian power grid blackout.", "source": "https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and" } ], "exploited_cves": [ "CVE-2014-4114" ], "c2_profile": { "protocols": [ "HTTP", "HTTPS", "TCP", "Base64 Encoded POST" ], "ports": [ 80, 443, 8080 ], "infrastructure": "Multi-tiered proxy servers hosted across compromised routers and bulletproof VPS providers transmitting encrypted Base64 and XOR-encoded XML/JSON payloads to modular DLL loaders." }, "iocs": { "file_hashes": [ "0f62d1c9ad9a64797a731efc1b4cfb0cc5a1b5d12de1d668749a46995642456e", "294ac5e533c37560d2b8feeb492f58cfcb6c3c6efec24bb93b22cfd8ccb05612" ], "delivery": [ "Spear-phishing emails containing malicious Microsoft PowerPoint (.pps/.ppt) documents weaponized with CVE-2014-4114", "Phishing emails disguised as official Ukrainian energy authority communications delivering weaponized macro-enabled Excel sheets" ], "persistence": [ "Kernel-mode rootkit drivers installed in %SYSTEM32%\\drivers", "Scheduled Tasks executing rundll32.exe with encrypted configuration files in %APPDATA%" ] }, "sources": [ { "name": "US DOJ Indictment of Six Russian GRU Officers", "url": "https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and" }, { "name": "CISA Advisory - Cyber-Attack Against Ukrainian Critical Infrastructure", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories" }, { "name": "MITRE ATT&CK - BlackEnergy (S0089)", "url": "https://attack.mitre.org/software/S0089/" } ], "mitre_attack_detail": [ { "id": "T1055", "name": "Process Injection", "tactic": "Defense Evasion" }, { "id": "T1059.003", "name": "Command and Scripting Interpreter: Windows Command Shell", "tactic": "Execution" }, { "id": "T1562.001", "name": "Impair Defenses: Disable or Modify Tools", "tactic": "Defense Evasion" }, { "id": "T1485", "name": "Data Destruction", "tactic": "Impact" }, { "id": "T1071.001", "name": "Application Layer Protocol: Web Protocols (C2 Communication)", "tactic": "Command and Control" }, { "id": "T1082", "name": "System Information Discovery", "tactic": "Discovery" } ], "containment_steps": [ "Enforce forensic network isolation on all suspected endpoints while maintaining an out-of-band telemetry conduit to capture live Blackenergy adversary activity.", "Perform full memory dumps across identified staging nodes to extract memory-only implants, kernel rootkit hooks, and decrypted Blackenergy C2 infrastructure IP/domain lists.", "Review Active Directory domain controller authentication logs for anomalous Kerberos ticket requests (Pass-the-Ticket, Golden Ticket) and unauthorized DCSync operations associated with Blackenergy.", "Block all confirmed C2 domains, dynamic DNS endpoints, and proxy IP addresses across perimeter firewalls, proxies, and DNS security gateways.", "Conduct an enterprise-wide sweep across surrounding subnets for secondary webshells, WMI event subscriptions, or remote execution tooling left behind by Blackenergy operators." ], "what_to_avoid": [ "Do not assume the incident is resolved simply because an antivirus tool removed the initial Blackenergy dropper; always verify that secondary payloads and persistence hooks have been eradicated.", "Avoid logging in with Domain Admin or privileged credentials on a machine suspected of running Blackenergy until memory triage is complete.", "Do not delay host isolation; automated lateral movement and credential dumping can occur within minutes of initial execution." ], "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }