Skip to content

BlackEnergy

Software · ATTACK:enterprise:S0089

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0089",
  "title": "BlackEnergy",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0089",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--54cc1d4f-5c53-4f0e-9ef5-11b4998e82e4",
  "external_id": "S0089",
  "domain": "enterprise",
  "created": "2017-05-31T21:32:57.807Z",
  "modified": "2023-10-06T14:08:40.134Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "F-Secure BlackEnergy 2014",
      "url": "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"
    }
  ]
}

Explicit source assertions (27)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--054a22c3-f0ee-476a-b0cb-e3277c755032

F-Secure BlackEnergy 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c0b4142-96e7-440b-a01f-f2bda05649b1

Securelist BlackEnergy Feb 2015

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d4d7376-5bda-44bc-b90d-0a065bb99433

F-Secure BlackEnergy 2014 · Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12c761e7-f026-4e14-80fb-da9f4cb0ca38

F-Secure BlackEnergy 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--147d2e66-25de-42ea-8592-eb51333f595c

Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a7d1db3-9383-4171-8938-382e9b0375c6

F-Secure BlackEnergy 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--201a9d42-beef-4cab-866a-0e045d83eb21

ESEST Black Energy Jan 2016

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1553.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2856e2ad-4fcd-483a-85bb-99fe8304ee8d

F-Secure BlackEnergy 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c586158-d02b-468a-bee8-04e1bde320e1

F-Secure BlackEnergy 2014 · Securelist BlackEnergy Nov 2014 · ESET BlackEnergy Jan 2016

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37f94533-8fbe-48d2-bf4f-f825ad75ff98

F-Secure BlackEnergy 2014 · Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47e4d006-2685-4628-a46b-f6d9066f3585

Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53d7b242-3ed6-4281-9829-e25d425e28fe

Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b2c87e3-8eac-48b3-832b-2290b367403d

F-Secure BlackEnergy 2014 · Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7cac6ccb-d070-47da-8ebf-4034b0fddb7c

Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8200c438-ec29-4f0e-81c3-9a058c735748

F-Secure BlackEnergy 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aec49e52-c54e-45be-a476-70aa0dc42cfb

F-Secure BlackEnergy 2014 · Securelist BlackEnergy Nov 2014

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:S0089

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b349ef5f-4a05-4eef-afe4-1543b8c832fa

iSIGHT Sandworm 2014 · F-Secure BlackEnergy 2014 · US District Court Indictment GRU Unit 74455 October 2020 · UK NCSC Olympic Attacks October 2020 · Secureworks IRON VIKING

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbd9b8d7-431c-44fa-95ac-61f73271ae92

Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c48f6a1b-1599-4e82-a7b6-1f7b5186e99e

F-Secure BlackEnergy 2014

ATTACK:enterprise:C0028 → uses → ATTACK:enterprise:S0089

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8e78d6f-ac9d-4ad3-ae13-238f1eb4423a

Booz Allen Hamilton

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd2a7854-1339-4f40-8ba1-be032dc5249e

F-Secure BlackEnergy 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1485

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5166d3e-246b-473c-9ff0-c5cc97dd91de

Securelist BlackEnergy Feb 2015 · ESET BlackEnergy Jan 2016

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1574.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da1a5240-bbd7-4e91-9dee-9b14df6cffe2

F-Secure BlackEnergy 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de168dd4-3c59-4fa4-901a-911b1ee81a31

F-Secure BlackEnergy 2014 · Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--efa98949-4b58-4407-8fa2-366c06dc2ed9

F-Secure BlackEnergy 2014 · Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5936bbd-f8cb-404a-bd43-87f7bc836294

Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5a175ba-ed26-44f8-9828-c2aa0e1f7d86

F-Secure BlackEnergy 2014

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.