GreyEnergy: Beyond BlackEnergy and NotPetya
summary
GreyEnergy is a stealthy backdoor framework tied to BlackEnergy and TeleBots that targets the energy sector in Ukraine and Poland, with seven confirmed targets so far. Initial access comes from spear‑phishing macros and exploitation of a vulnerable PHP/Apache server to pivot; lateral movement uses stolen credentials and internal C2 proxies. Artifacts include a Moonraker worm used to spread in one network, a KillDisk‑style wiper masquerading as ransomware, and a stolen Advantech code-signing certificate. Activity emphasizes reconnaissance and persistence and likely serves as preparation for future destructive attacks.
AI-written summary · about
chapters (8)
- 0:00BlackEnergy
- 2:12Deja Vu
- 4:03Teleports
- 7:24Ransomware
- 9:34XML
- 10:45GreyEnergy
- 13:12GreyEnergy Functionality
- 14:46Tactics
related talks
39mThe Renaissance of Cyber Physical Offensive Capabilities
34mEgregor Awakens: Taking a Tour of a Threat Action New Digs
47mThe Blurred Lines between Cybercrime and Statecraft
49mThe State Of Malware From The Eye Of The Tiger
46mAttacks, Lies and the Underground World
19mOperation PZCHAO
42mStart Covering Your Bases And Stop Chasing APT Headlines
25mGlobal Threat Brief: Hacks and Adversaries Unveiled