New GreyEnergy Malware Targets ICS, Tied with BlackEnergy and TeleBots

guest · Oct 17, 2018

New GreyEnergy Malware Targets ICS, Tied with BlackEnergy and TeleBots
October 17, 2018
https://www.bleepingcomputer.com/ne...rgets-ics-tied-with-blackenergy-and-telebots/

A new advanced threat actor is now on the public map of adversaries that target systems in the critical infrastructure sector. The name is GreyEnergy and it shows similarities with the BlackEnergy group.

The GreyEnergy malware has no destructive capabilities at the moment, and it seems focused on espionage and reconnaissance operations on industrial control system workstations running SCADA software and servers.
Legitimate tools for nefarious purposes
Security researchers at ESET noticed that the initial attack stage uses a different piece of malware, they call 'GreyEnergy mini' - also known as FELIXROOT, which does not require administrator privileges.

An interesting discovery ESET made was in one sample of the malware, which was digitally signed with a certificate, most likely stolen, from Advantech, a company in Taiwan that makes industrial equipment and connected devices.

What is certain, though, is that "that the threat actors responsible for GreyEnergy are extremely dangerous in their persistence and stealth," the researchers conclude.
Click to expand...

Minimalist · Nov 23, 2018

Phishing Used to Launch GreyEnergy's ICS Attacks

The advanced persistent threat (APT) group GreyEnergy has been targeting industrial networks across Ukraine and Eastern Europe for years, and according to analysis of the group’s activity, the attacks begin with a malicious document sent in a phishing email.

Nozomi Networks performed analysis on the GreyEnergy advanced ICS malware and found that the tools and tactics used by the threat actors allowed the group to stay under the radar of typical anomaly detection tools for a long time.
Click to expand...

https://www.infosecurity-magazine.com/news/phishing-used-to-launch/

guest · Jan 16, 2019

GreyEnergy: Welcome to 2019
January 16, 2019
https://securityaffairs.co/wordpress/79967/malware/greyenergy-welcome-to-2019.html

Early January, an interesting malware sample has been disclosed through the InfoSec community: a potential GreyEnergy implant still under investigation. [...]
Conclusion
The sample disclosed in January 2019 is clearly classifiable as GreyEnergy malware implant with highest level of confidence: the behaviour, the configurations and the static data closely match TTP and technical details from previous analysis.

This means the analyzed sample is linked to the BlackEnergy/Sandworm APT group.
The lack of contextual data about this new sample makes the determination of the current targeted organizations harder; however CERT-Yoroi assessed no organization part of its constituency have been impacted by this threat.

Further details, including IoCs and Yara rules are reported in the analysis published by Yoroi.
Click to expand...

Minimalist · Feb 12, 2019

GreyEnergy malware has 'massive amounts of junk code' meant to confuse researchers

The investigation of the network of hackers generally associated with the seminal 2015 cyberattack on the Ukrainian power grid continues. A researcher has reverse-engineered malware used by a subgroup of those attackers and found “massive amounts of junk code” meant to throw analysts off the trace.
Click to expand...

https://www.cyberscoop.com/greyenergy-reverse-engineered-nozomi/

Log in or Sign up

New GreyEnergy Malware Targets ICS, Tied with BlackEnergy and TeleBots

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Log in or Sign up

New GreyEnergy Malware Targets ICS, Tied with BlackEnergy and TeleBots

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Useful Searches