Trusted Design

BlackEnergy APT Attacks in Ukraine employ spearphishing Word

概要

Late last year, a wave of cyber-attacks hit several critical sectors in Ukraine. Widely discussed in the media, the attacks took advantage of known BlackEnergy Trojans as well as several new modules. BlackEnergy is a Trojan that was created by a hacker known as Cr4sh. In 2007, he reportedly stopped working on it and sold the source code for an estimated $700. The source code appears to have been picked by one or more threat actors and was used to conduct DDoS attacks against Georgia in 2008. These unknown actors continued launching DDoS attacks over the next few years. Around 2014, a specific user group of BlackEnergy attackers came to our attention when they began deploying SCADA-related plugins to victims in the ICS and energy sectors around the world. This indicated a unique skillset, well above the average DDoS botnet master.

Created: 2026-02-23

Indicators

• FileHash-MD5 - e15b36c2e394d599a8ab352159089dd2 -
• FileHash-MD5 - ac2d7f21c826ce0c449481f79138aebd -
• FileHash-MD5 - 3fa9130c9ec44e36e52142f3688313ff -

類似Pulses

• BlackEnergy by the SSHBearDoor (score: 0.79)
• Domains and Hostnames from the BlackEnergy report (score: 0.75)
• Updated BlackEnergy Trojan Grows More Powerful (McAfee) (score: 0.74)
• BlackEnergy Malware (score: 0.73)
• New wave of cyberattacks against Ukrainian power industry (score: 0.71)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る