Black Energy Black Energy

  • First known sample

    2010

  • Discovery

    2013

  • Number of targets

    100-1000

  • Current status

    Active

  • Type

    Complex cyberattack platform

  • Targeted platforms

    Cisco IOS , Linux , Windows

  • TOP targeted countries

    Azerbaijan , Belarus , Iran , Israel , Kazakhstan , Kyrgyzstan , Lithuania , Poland , Russia , United Arab Emirates

  • The way of propagation

    File infection , LAN spreading , Social engineering , USB cables

  • Purpose/Functions

    Cyberespionage , DDoS , Data theft , Data wiping
  • Special features
    The malware has a wide range of targets: power generation site owners, power facilities construction, power generation operators, large suppliers and manufacturers of heavy power related materials, investors, high level government, other ICS construction, federal land holding agencies, municipal offices, federal emergency services, space and earth measurement and assessment labs, national standards body, banks, high-tech transportation, academic research.

  • Targets

    Wide range of targets
  • Artefacts/Attribution
    Russian-speaking authors
  • Description

    This malware is well-known for its highly destructive activity. After spear-phishing its way into systems, it’s taken down hard drives, host systems, network equipment, business organizations, worldwide shipping enterprises, ATMS, railways, news media organizations, and electrical grids. It’s also targeted remote server side ICS software and network equipment vulnerabilities.

    Additional information

© 2024 AO Kaspersky Lab. All Rights Reserved. Privacy Policy Cookies
  1. Adding detection for known modules
  2. Collecting samples
  3. Reversing the samples
  4. Decrypting sophisticated encryption and compression schemes
  5. Understanding lateral movement
  6. Outlining multiple attack stages in the correct order
  7. Mapping C&C infrastructure
  8. Setting up sinkholes
  9. Analyzing collected traffic and communication protocols
  10. Crawling other hosts that understand the same protocol
  11. Taking down and acquiring images of C&C servers
  12. Identifying victims, sending out notifications to victims and global CERTs
  13. Applying forensic analysis and extracting logs, stolen files, other components
  14. Collecting and analyzing data from KSN, C&C servers, individual victims who are willing to work with us, sinkholes, crawlers, etc.
  15. Writing a comprehensive report
Read more
Mitigation is where enterprises need to start, prevention being significantly more effective and more cost-efficient than remediation after an attack Read more
For any inquiries, please contact apt.securelist@kaspersky.com If you are looking for more detailed information about an APT, please contact intelreports@kaspersky.com