{
  "family": "blackenergy",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nBlackEnergy is a highly sophisticated, modular malware family that has evolved significantly over its lifespan. Originally created in 2007 by a Russian hacker named \"Cr4sh\" as a relatively simple toolkit for generating DDoS botnets, BlackEnergy 2 and BlackEnergy 3 were later adopted and heavily modified by Advanced Persistent Threat (APT) groups (notably Sandworm). It is most infamous for its role in the highly targeted, destructive cyberattacks against the Ukrainian power grid in 2015, marking one of the first known instances of malware causing physical power outages.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nIn its APT form, BlackEnergy is deployed via highly targeted spear-phishing campaigns containing weaponized Microsoft Office documents or via the exploitation of exposed internet-facing infrastructure (like vulnerable VPN gateways).\n\nUpon execution, BlackEnergy operates as a highly modular, stealthy framework:\n<ul>\n<li><strong>Rootkit Capabilities:</strong> Early versions (BE1/BE2) heavily utilized rootkit techniques (often a `.sys` driver) to deeply hook into the Windows kernel. This allowed the malware to hide its files, processes, and network connections from the operating system and standard security software.</li>\n<li><strong>Modular Plugin Architecture:</strong> BlackEnergy's true power lies in its modularity. The core bot acts as a loader, contacting its C2 server to download specialized plugins based on the target environment. Known plugins include: network scanners, password stealers, keyloggers, and custom modules designed to interact with Industrial Control Systems (ICS) and SCADA environments.</li>\n<li><strong>Destructive Payloads (KillDisk):</strong> In the Ukrainian power grid attacks, BlackEnergy was used to gain initial access and deploy a secondary, highly destructive payload known as KillDisk. KillDisk was designed to overwrite the Master Boot Record (MBR) and delete critical system files, rendering the operator workstations unbootable and delaying recovery efforts.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of BlackEnergy (specifically versions 2 or 3) is a critical, \"break-glass\" security incident. It strongly indicates a targeted attack by a highly resourced, nation-state-aligned APT group. The presence of BlackEnergy suggests that the attackers are likely seeking to establish deep persistence for espionage or to stage a destructive attack against critical infrastructure.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Incident Response Activation:</strong> Standard IT remediation is insufficient. The discovery of BlackEnergy requires the immediate activation of a specialized, enterprise-wide Incident Response (IR) team and potentially notification of relevant national cybersecurity authorities (e.g., CISA).</li>\n<li><strong>Forensic Preservation and Network Segmentation:</strong> Do not immediately reboot or wipe infected machines, as this may destroy critical volatile memory forensics. Isolate the affected network segments (especially if bridging IT and OT/ICS networks) to contain the spread.</li>\n<li><strong>Hunt for Lateral Movement:</strong> Assume the entire network is compromised. Responders must aggressively hunt for signs of lateral movement, compromised administrative credentials, and the deployment of secondary destructive payloads (like KillDisk) across all servers and endpoints.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "APT.BlackEnergy",
    "Backdoor.BlackEnergy",
    "Win32/BlackEnergy",
    "Sandworm Toolkit"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1014",
    "T1059",
    "T1566.001",
    "T1485",
    "T1561.002",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:16:56Z",
  "type": "APT / ICS Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}