BlackEnergy

BlackEnergy is a potent malware toolkit that has been utilized by criminal and Advanced Persistent Threat (APT) actors since 2007. Its destructive capabilities were notably demonstrated in Ukraine where it was used for cyber-espionage, compromising industrial control systems, and launching attacks against media companies. The Sandworm group, also known as BlackEnergy APT, operating under the control of Unit 74455 of the Russian GRU’s Main Center for Special Technologies (GTsST), first employed BlackEnergy in attacks against Ukraine in 2015. The malware can infiltrate systems through malicious Microsoft Office documents; once opened, it deploys the BlackEnergy 3 malware variant. The Industroyer main backdoor's strong code similarity to the Win32/Exaramel backdoor is the first public evidence linking Industroyer to TeleBots, and consequently to NotPetya and BlackEnergy. This linkage suggests that these tools are part of a larger arsenal employed by the same threat actors. Notable instances include the disruption of Ukraine's power grid in 2016 with the use of BlackEnergy malware by Russian threat actors, and other high-profile attacks on critical infrastructure networks. Despite their age, these tools remain active threats, demonstrating their lasting effectiveness. The evolution of the BlackEnergy malware is evident in its successors, GreyEnergy and Kapeka. These new variants share conceptual overlaps with BlackEnergy, suggesting a continuous development and refinement of this malware family. It is speculated that Kapeka is a successor to GreyEnergy, which itself likely replaced BlackEnergy in Sandworm's arsenal. These developments highlight the persistent and evolving nature of cyber threats posed by sophisticated actors like Sandworm.