MITRE ATT&CKsoftware (malware)

S0089 BlackEnergy

Published 2017-05-31 Modified 2023-10-06 Official page ↗
Domain
enterprise, ics
Platforms
Windows
Aliases
Black Energy
Version
1.4
Created
2017-05-31

Description

BlackEnergy is a malware toolkit that has been used by both criminal and APT actors. It dates back to at least 2007 and was originally designed to create botnets for use in conducting Distributed Denial of Service (DDoS) attacks, but its use has evolved to support various plug-ins. It is well known for being used during the confrontation between Georgia and Russia in 2008, as well as in targeting Ukrainian institutions. Variants include BlackEnergy 2 and BlackEnergy 3.

Related

Uses · MITRE ATT&CK (28)

  • T1685.005 Clear Windows Event Logs sub-technique
  • T1553.006 Code Signing Policy Modification sub-technique
  • T0859 Valid Accounts technique
  • T0865 Spearphishing Attachment technique
  • T0869 Standard Application Layer Protocol technique
  • T1071.001 Web Protocols sub-technique
  • T1574.010 Services File Permissions Weakness sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1056.001 Keylogging sub-technique
  • T1552.001 Credentials In Files sub-technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1547.009 Shortcut Modification sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1543.003 Windows Service sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1485 Data Destruction technique
  • T1008 Fallback Channels technique
  • T1016 System Network Configuration Discovery technique
  • T1046 Network Service Discovery technique
  • T1047 Windows Management Instrumentation technique
  • T1049 System Network Connections Discovery technique
  • T1057 Process Discovery technique
  • T1070 Indicator Removal technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1113 Screen Capture technique
  • T1120 Peripheral Device Discovery technique

Referenced by MITRE ATT&CK · uses (2)

  • C0028 2015 Ukraine Electric Power Attack campaign
  • G0034 Sandworm Team group

References