ESET has uncovered details of a successor to the BlackEnergy APT group. Named GreyEnergy by ESET, this threat actor focuses on espionage and reconnaissance, quite possibly in preparation for future cybersabotage attacks. <\/p>\n
BlackEnergy has been terrorizing Ukraine for years and rose to prominence in December 2015 when they caused a blackout that left 230 thousand people without electricity in the first-ever blackout caused by a cyberattack. Around the time of that breakthrough incident, ESET researchers started detecting another malware framework and named it GreyEnergy.<\/p>\n
\u201cWe have seen GreyEnergy involved in attacks at energy companies and other high-value targets in Ukraine and Poland over the past three years,\u201d says Anton Cherepanov, ESET Senior Security Researcher who led the research. <\/p>\n
The 2015 attack on Ukrainian energy infrastructure was the most recent known operation where the BlackEnergy toolset was used. Subsequently, ESET researchers documented a new APT subgroup, TeleBots. <\/p>\n
TeleBots are most notable for the global outbreak of NotPetya, the disk-wiping malware that disrupted global business operations in 2017 and caused damages in the sum of billions of US dollars. As ESET researchers recently confirmed, TeleBots are also connected to Industroyer, the most powerful modern malware targeting industrial control systems and the culprit behind the second electrical blackout in Ukraine\u2019s capital, Kiev, in 2016. <\/p>\n
\u201cGreyEnergy surfaced along with TeleBots, but unlike its better-known cousin, GreyEnergy\u2019s activities are not limited to Ukraine and so far, haven\u2019t been damaging. Clearly, they want to fly under the radar,\u201d comments Anton Cherepanov. <\/p>\n
According to ESET\u2019s thorough analysis, GreyEnergy malware is closely related to both BlackEnergy and TeleBots malware. It is modular in construction, so its functionality is dependent on the particular combination of modules its operator uploads to the victim\u2019s systems. <\/p>\n
The modules described in ESET\u2019s analysis were used for espionage and reconnaissance purposes and include: backdoor, file extraction, taking screenshots, keylogging, password and credential stealing, etc.<\/p>\n
\u201cWe have not observed any modules that specifically target Industrial Control Systems software or devices. We have, however, observed that GreyEnergy operators have been strategically targeting ICS control workstations running SCADA software and servers,\u201d explains Anton Cherepanov.<\/p>\n
ESET\u2019s disclosure and analysis of GreyEnergy is important for a successful defense against this particular threat actor as well as for better understanding the tactics, tools and procedures of the most advanced APT groups. <\/p>\n
More details can be found in the HYPERLINK “https:\/\/www.welivesecurity.com\/2018\/10\/17\/greyenergy-updated-arsenal-dangerous-threat-actors\/” WeLiveSecurity.com blogpost and the HYPERLINK “https:\/\/gpc.eset.com\/gpc\/filebrowser\/file\/4906” white paper.<\/p>\n
Note for editors: When ESET Research describes cyberattacks and tracks cybercriminal groups, it is drawing connections based on technical indicators such as code similarities, shared Command & Control infrastructure, malware execution chains and other evidence. Since ESET is not involved in on-the-ground law-enforcement or intelligence investigations, we are not speculating on any potential nation-state attribution for these attacks.<\/p>\n","protected":false},"excerpt":{"rendered":"
ESET has uncovered details of a successor to the BlackEnergy APT group. Named GreyEnergy by ESET, this threat actor focuses on espionage and reconnaissance, quite possibly in preparation for future cybersabotage attacks. BlackEnergy has been terrorizing Ukraine for years and rose to prominence in December 2015 when they caused a blackout that left 230 thousand […]<\/p>\n","protected":false},"author":8,"featured_media":1618,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"1","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":0,"_extra_hide_author_box":"","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-8905","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\n