October 23, 2018 By Douglas Bonderud 2 min read

A new APT group dubbed GreyEnergy is now targeting energy companies in Poland and Ukraine, and analysis of the new threat vector revealed that it may be a successor to the BlackEnergy attacks of 2015.

While GreyEnergy has been active for the past three years, according to We Live Security, its lack of destructive behavior helped it evade detection. In fact, the attack uses multiple stealth and obfuscation techniques to prevent security professionals from detecting its presence.

Similarities in framework and function tie this new advanced persistent threat (APT) group to both BlackEnergy and the TeleBots subgroup, which helped develop the NotPetya ransomware. Like BlackEnergy, GreyEnergy targets supervisory control and data acquisition (SCADA) and industrial control system (ICS) workstations. GreyEnergy appeared in the wild when its presumed predecessor disappeared, and both attacks use modular frameworks to deploy mini-backdoors before obtaining full admin rights.

As for its TeleBots connection, GreyEnergy was detected in 2016 using an early version of the NotPetya worm. So far, GreyEnergy has focused on reconnaissance and data espionage, but this could be a precursor to blackout-type attacks conducted by its BlackEnergy birthright.

Breaking Down the APT Group’s Stealthy Tactics

GreyEnergy isn’t looking for attention. Instead, attackers are compromising public-facing web servers and deploying traditional spear phishing techniques to infect corporate systems and quietly get to work.

Both BlackEnergy and GreyEnergy rely on stealth deployments — that is, they only push malware modules to select targets, and only when required. In addition, the malware encrypts some files using Advanced Encryption Standard 256-bit encryption (AES-256) and leaves others running filelessly in memory to frustrate detection efforts.

The APT group is deploying internal command-and-control (C&C) proxies on victim networks to redirect traffic requests from infected hosts. As a result, defenders see devices communicating on internal networks when traffic is actually being rerouted to external servers.

Why You Should Test Your SCADA and ICS Systems

To avoid the threat posed by GreyEnergy and similar ICS-targeting ADP groups, security experts recommend consistently testing ICS and SCADA for vulnerabilities. While many companies are reluctant to risk critical system downtime with this kind of testing, minor outages are preferable to complete system compromise.

Security professionals should also monitor their environments for the indicators of compromise (IoCs) listed on IBM X-Force Exchange.

Source: We Live Security

More from

ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malware

11 min read - As of December 2023, IBM X-Force has uncovered multiple lure documents that predominately feature the ongoing Israel-Hamas war to facilitate the delivery of the ITG05 exclusive Headlace backdoor. The newly discovered campaign is directed against targets based in at least 13 nations worldwide and leverages authentic documents created by academic, finance and diplomatic centers. ITG05’s infrastructure ensures only targets from a single specific country can receive the malware, indicating the highly targeted nature of the campaign.X-Force tracks ITG05 as a…

Exploiting GOG Galaxy XPC service for privilege escalation in macOS

7 min read - Being part of the Adversary Services team at IBM, it is important to keep your skills up to date and learn new things constantly. macOS security was one field where I decided to put more effort this year to further improve my exploitation and operation skills in macOS environments. During my research, I decided to try and discover vulnerabilities in software that I had pre-installed on my laptop, which resulted in the discovery of this vulnerability. In this article, I…

Taking the complexity out of identity solutions for hybrid environments

4 min read - For the past two decades, businesses have been making significant investments to consolidate their identity and access management (IAM) platforms and directories to manage user identities in one place. However, the hybrid nature of the cloud has led many to realize that this ultimate goal is a fantasy. Instead, businesses must learn how to consistently and effectively manage user identities across multiple IAM platforms and directories. As cloud migration and digital transformation accelerate at a dizzying pace, enterprises are left…

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today