ICS / nation-stateATT&CK S0089
BlackEnergy
Also known as: Black Energy
BlackEnergy started around 2007 as a criminal toolkit for DDoS attacks and evolved into a modular espionage platform. Version 3 was found on the networks of Ukrainian electricity distribution companies hit in December 2015, although CISA noted that its exact role in the outage was unknown.
- Public attribution and associated actors
- MITRE ATT&CK lists BlackEnergy as used by Sandworm Team. CISA's alert on the December 2015 Ukraine grid attack states that the US Government attributes that activity to Russian nation-state cyber actors.As publicly reported:Sandworm Team
- First seen
- Around 2007
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0089 BlackEnergy
How it spreads or gets in
- Spearphishing emails with malicious Office attachments, according to public reporting summarised by CISA.
Key behaviours
- Stole credentials and logged keystrokes.
- Ran plugins for network discovery and remote control.
- Was used alongside the KillDisk wiper in Ukraine.
ATT&CK techniques
- T0865Spearphishing Attachment
- T0859Valid Accounts
- T1056.001Input Capture: Keylogging
- T1021.002Remote Services: SMB/Windows Admin Shares
- T1547.009Boot or Logon Autostart Execution: Shortcut Modification
- T1553.006Subvert Trust Controls: Code Signing Policy Modification
- T1485Data Destruction
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Alert when Office documents spawn processes on corporate and OT-adjacent hosts.
- Detect changes to driver signing policy.
- Monitor VPN and remote access into OT networks for unusual use.
Defences that work
- Filter attachments and block macros from the internet.
- Require MFA for any remote access into OT networks.
- Segment IT and OT so a phishing foothold cannot reach control systems.