{"id":15024,"date":"2014-11-11T17:52:16","date_gmt":"2014-11-11T17:52:16","guid":{"rendered":"http:\/\/kasperskydaily.com\/b2b\/?p=2842"},"modified":"2020-02-27T03:50:58","modified_gmt":"2020-02-26T16:50:58","slug":"blackenergy-2-a-good-set-or-bad-deeds","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/blackenergy-2-a-good-set-or-bad-deeds\/15024\/","title":{"rendered":"BlackEnergy 2: a good set or bad deeds"},"content":{"rendered":"

A new article had been released on Securelist<\/a>, dedicated to the already notorious BlackEnergy crimeware toolkit, which has been used most recently by Sandworm APT group, also known as BE2 APT.<\/p>\n

\u00a0<\/p>\n

\n<\/p>

\u00a0<\/p>\n

While the majority of the research is mostly technical, there are a number of details which may require attention from business people. We\u2019ll try to cover them in this post.<\/p>\n

So, what is BlackEnergy? Initially a DDoS crimeware, it turned into a huge collection of various tools currently used in various APT-type activities, including what Kurt Baumgartner and Maria Garnaeva called \u201csignificant geopolitical operations\u201d.<\/p>\n

The most interesting point here is that BlackEnergy is a modular tool that comprises a lot of various plugins with capabilities to attack a multitude of platforms, including ARM and MIPS; there are also scripts for Cisco network devices, certificate stealers, and destructive plugins.<\/p>\n

Yes, destructive: Some are clearly purposed to kill hard drives by overwriting all of the information on them with random data mash.<\/p>\n

#BlackEnergy 2: a good set or bad deeds<\/p>Tweet<\/a><\/blockquote>\n

Kaspersky Lab\u2019s experts don\u2019t know the total number of plugins associated with BlackEnergy (or, to be more specific, BlackEnergy 2 and BlackEnergy 3 \u2013 the currently known APT tools), nor do they know how many hacking groups have BE at their disposal. The Sandworm APT team has drawn a lot of attention to itself due to its high-profile attacks on high-profile targets, but it doesn\u2019t mean there aren\u2019t any other groups that may be using the same tools right now, fortunate enough to remain undiscovered.<\/p>\n

The Sandworm\/BE2 APT group had been hitting the larger entities<\/a> and clearly displayed an expansive interest in ICS. Among their victims are:<\/p>\n