Trusted Design

BlackEnergy Malware

概要

These attacks are active and ongoing as of early January, 2016. The BlackEnergy family of malware first appeared on the scene in 2007, as a botnet engine to perform Distributed Denial of Service (DDoS) attacks. By 2010, BlackEnergy 2 had developed rootkit capabilities. In 2014 and 2015, it dropped rootkit capability, and improved modularity with a plug-in framework, reducing its footprint on the network and the victim machines. In 2013, Quedagh variants also gained capabilities to bypass 64-bit Windows' User Access Controls (UAC) and driver signing. The architecture includes plug-ins for network discovery, information theft, remote code execution, credential theft, and data destruction, among others. Variants support both Windows and Linux targets, including ARM/MIPS architectures, as well as some Cisco routers and some SCADA equipment. Several BlackEnergy variants are available on the open market in the Russian cyber underground.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• BlackEnergy APT Attacks in Ukraine employ spearphishing Word (score: 0.73)
• Updated BlackEnergy Trojan Grows More Powerful (McAfee) (score: 0.67)
• BlackEnergy by the SSHBearDoor (score: 0.67)
• 20160203-BlackEnergy by maldoc,Malware (score: 0.64)
• New wave of cyberattacks against Ukrainian power industry (score: 0.60)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る