Cosmicenergy

Malware updated 4 days ago (2024-11-29T13:37:03.898Z)
Download STIX
Preview STIX
CosmicEnergy is a form of malware allegedly originating from Russia that targets industrial control systems, specifically those associated with electrical grids. Unlike other forms of malware, CosmicEnergy lacks the built-in functionality to autonomously discover and identify target systems within a network. Instead, attackers must conduct prior reconnaissance such as gathering IP addresses of MSSQL servers and target IEC-104 devices, identifying critical systems and their vulnerabilities. The malware utilizes an MSSQL server as a gateway to access Operational Technology (OT) systems. Once inside, it can manipulate power line switches and circuit breakers, leading to potential power disruptions. The malware shares similarities with Industroyer and its variants, interacting with the IEC-104 protocol to cause electric power disruption, much like Industroyer. It issues IEC-104 ON/OFF commands to interact with Remote Terminal Units (RTUs). Despite these capabilities, as of now, CosmicEnergy is not considered an immediate threat but should not be ignored given its potential for significant disruption. Recent advisories from organizations such as the FBI and the Critical Infrastructure Security Agency have highlighted destructive attack vectors, including CosmicEnergy. Over the past two months, CosmicEnergy has been implicated in attacks affecting thousands of downstream victims, including government agencies. This new strain of malware, discovered in 2023, is part of a series of OT-specific malware that began with Stuxnet in 2010. Other recent strains include Industroyer2 and Incontroller, both discovered last year. According to Mandiant, CosmicEnergy operates using two derivative components named Piehop and Lightwork.
Description last updated: 2024-05-04T18:38:49.501Z
What's your take? (Question 1 of 0)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Industroyer2 is a possible alias for Cosmicenergy. Industroyer2 is a sophisticated piece of malware designed to target Industrial Control Systems (ICS), developed and deployed by the Russian state-sponsored advanced persistent threat group, Sandworm. The group has been active since 2007 and used Industroyer2 in a significant attack against Ukraine's
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.