Log in Request a demo

Malware profile

BlackEnergy

Also known as BlackEnergy 2, BlackEnergy 3

BlackEnergy is a malware toolkit for Windows.

In short

BlackEnergy is a malware toolkit for Windows. MITRE ATT&CK says it dates back to at least 2007 and was first built to create botnets for DDoS attacks, and that its use grew to support plug-ins. It was found on the networks of Ukrainian power companies in December 2015, though CISA says it could not confirm that BlackEnergy caused the outages.

Last updated 9 October 2026

Profile MapMalware
  1. Names4names in public reportsBlackEnergy · Black Energy · BlackEnergy 2
  2. Techniques18ATT&CK techniques listedCommand and Control · Discovery · Lateral Movement
  3. Infection Steps5in the delivery chainSpear phishing · Network access
  4. Linked Groups1groups that use itSandworm

In one minute

What it is
A malware toolkit for Windows that dates back to at least 2007 and grew from a DDoS botnet tool into a plug-in framework.
What it does
Runs plug-ins that capture keystrokes and screenshots, gather saved passwords, scan the network and, in one case, overwrite files. It talks to its command server over HTTP.
Who uses it
Attributed by the US Department of Justice, in an indictment announced 19 October 2020, to officers of GRU Unit 74455 (Sandworm). MITRE also lists Sandworm Team as a user.
How it gets in
Spear phishing emails with Microsoft Office attachments in the 2015 Ukraine case. In an earlier campaign CISA reports Internet-connected control system screens (HMIs) as the target.
What to do first
Check systems with the YARA signature that CISA published in alert ICS-ALERT-14-281-01E, and keep control networks off the Internet.

What it does

CISA described a BlackEnergy campaign that compromised industrial control system environments, with the malware found on Internet-connected human-machine interfaces. It says the malware is highly modular, so not every function is deployed to every victim.

The December 2015 Ukraine power outages are its best-known case. Sources differ on its role. CISA says it does not know whether BlackEnergy played a role and that none of its specific capabilities were reportedly used. The US indictment and a 2022 CISA advisory say BlackEnergy was used to steal credentials.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
BlackEnergyMITRE ATT&CK software S0089 and CISA alerts ICS-ALERT-14-281-01E and IR-ALERT-H-16-056-01[1, 2, 4]
Black EnergyMITRE ATT&CK Associated Software[1]
BlackEnergy 2Variant named by MITRE; CISA writes it as BE2[1, 2]
BlackEnergy 3Variant named by MITRE; CISA writes it as BE3 and confirmed a BlackEnergy 3 variant in the Ukraine case[1, 2]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Command and Control

  • Fallback Channels T1008

    It can use a backup channel through plus.google.com.[1]

  • Application Layer Protocol: Web Protocols T1071.001

    It talks to its command server over HTTP.[1]

Discovery

  • System Network Configuration Discovery T1016

    It has collected network IP settings with ipconfig.exe and routing tables with route.exe.[1]

  • Network Service Discovery T1046

    It has run port scans on a host.[1]

  • Process Discovery T1057

    It has collected a list of running processes with Tasklist.exe.[1]

  • Peripheral Device Discovery T1120

    It can collect detailed information on attached USB devices.[1]

Lateral Movement

  • Remote Services: SMB/Windows Admin Shares T1021.002

    One plug-in has spread through a local network using PsExec and admin shares.[1]

Collection

  • Input Capture: Keylogging T1056.001

    It has run a keylogger plug-in on a victim.[1]

  • Screen Capture T1113

    It is able to take screenshots.[1]

Credential Access

  • Credentials from Password Stores: Credentials from Web Browsers T1555.003

    A plug-in has gathered saved credentials from Firefox, Google Chrome and Internet Explorer.[1]

  • Unsecured Credentials: Credentials In Files T1552.001

    A plug-in has collected credentials that programs such as The Bat!, Outlook and Windows Credential Store keep on the host.[1]

Impact

  • Data Destruction T1485

    BlackEnergy 2 has a Destroy plug-in that overwrites file contents on victim hard drives.[1]

Stealth

  • Process Injection: Dynamic-link Library Injection T1055.001

    It injects its DLL component into svchost.exe.[1]

Persistence

  • Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001

    BlackEnergy 3 drops its main DLL and adds a shortcut to it in the startup folder.[1]

  • Create or Modify System Process: Windows Service T1543.003

    One variant creates a new service with a fixed or random name.[1]

Privilege Escalation

  • Abuse Elevation Control Mechanism: Bypass User Account Control T1548.002

    It tries to get around default User Account Control settings on Windows 7 and later.[1]

Defense Impairment

  • Subvert Trust Controls: Code Signing Policy Modification T1553.006

    It has turned on the TESTSIGNING boot option so that a driver component can load.[1]

  • Disable or Modify Tools: Clear Windows Event Logs T1685.005

    Its KillDisk component can delete Windows Event Logs.[1]

How it spreads

For the 2015 BlackEnergy 3 case, CISA says the infection vector appears to have been spear phishing with a malicious Microsoft Word attachment, a departure from the ICS product vulnerabilities used to deliver BlackEnergy 2. On GE Cimplicity systems, CISA says attackers got the HMI server to run a malicious .cim file hosted on a server they controlled. MITRE says one plug-in has spread through a local network using PsExec and admin shares.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Spear phishing

    Emails with malware-laced files were sent to the companies' IT staff and system administrators.[5]

  2. Network access

    The attackers gained access to the three energy distribution companies' computer systems.[5]

  3. Credential theft

    The indictment says a variant of BlackEnergy was used to steal user credentials. CISA says it does not know whether BlackEnergy played a role in the outages.[5, 4]

  4. SCADA access

    The stolen credentials were used to reach the SCADA networks at the energy distribution companies.[5]

  5. Wiping

    KillDisk was run at the end of the attacks to delete event logs and other files and reboot the computers, which left them inoperable.[5]

Timeline

  1. 2007

    Earliest date MITRE gives

    MITRE says BlackEnergy dates back to at least 2007 and was first designed to build botnets for DDoS attacks.[1]

  2. 2008

    Georgia and Russia

    MITRE says the toolkit is well known for its use during the confrontation between Georgia and Russia in 2008.[1]

  3. 2011

    Campaign against control systems begins

    CISA says analysis indicates a BlackEnergy campaign against industrial control systems had been running since at least 2011.[2]

  4. October 8, 2014

    First CISA alert

    ICS-CERT released its first alert on the campaign, with technical indicators, to the US-CERT secure portal.[3]

  5. Late spring 2015

    Spear phishing begins

    The indictment says preparations for the Ukraine attack began in and around late spring 2015 with spearphishing emails.[5]

  6. December 23, 2015

    Ukraine power outages

    Three regional power distribution companies were hit, affecting about 225,000 customers. CISA found BlackEnergy on their networks but does not know its role.[4]

  7. October 19, 2020

    US charges and UK statement

    The US Department of Justice announced charges against GRU officers, and the UK Government listed BlackEnergy, December 2015, among attacks it attributes to the GRU unit GTsST.[6, 5]

  8. July 20, 2021

    CISA attribution

    CISA added that the US Government attributes the Ukraine activity to Russian nation-state cyber actors.[4]

  9. 2022

    CISA advisory AA22-110A

    A joint advisory says GTsST actors deployed BlackEnergy to steal credentials and used KillDisk in the December 2015 attack.[7]

Detection and defense

  1. Scan with CISA's YARA signature

    CISA says its YARA signature is the best method to detect BlackEnergy infections. Test it first in a test or development ICS environment, because it will not work on most field devices.[2, 4]

  2. Use the official resources

    Read ICS-ALERT-14-281-01E, which carries the YARA signature, and IR-ALERT-H-16-056-01. CISA keeps technical indicators in restricted alerts (IR-ALERT-H-16-043-01P, TLP Green) for US critical infrastructure on request.[2, 4]

  3. Isolate control networks

    CISA says to isolate ICS networks from untrusted networks, especially the Internet, and not to let control devices face the Internet directly.[2, 4]

  4. Limit remote access and use MFA

    CISA advises limiting remote access and using strong multi-factor authentication. The companies believed the attackers had valid credentials before the attack. Tying this to the credential techniques is our pairing.[4]

    Counters: T1552.001 T1555.003

  5. Allow only approved programs

    CISA says application allowlisting can detect and prevent execution of malware uploaded by attackers, and suits static systems such as HMI computers.[4]

  6. Patch control systems

    CISA advises applying patches in the ICS environment when possible, and removing or renaming default accounts.[2]

  7. Train staff against spear phishing

    The 2015 infections came by spear phishing, and advisory AA22-110A lists end-user awareness and training as a protective action.[4, 7]

  8. Plan for a breach

    CISA advises exercising contingency plans for safe operation or shutdown if the ICS is breached, with wiper malware such as KillDisk in mind.[4]

    Counters: T1485

Questions

What is BlackEnergy?

MITRE ATT&CK calls it a malware toolkit used by both criminal and APT actors. It dates back to at least 2007 and was first designed to create DDoS botnets, then grew to support plug-ins.

Did BlackEnergy cause the 2015 Ukraine power outage?

Sources differ. CISA says it found BlackEnergy on the companies' networks but does not know whether it played a role, and could not confirm a causal link. The US indictment and CISA advisory AA22-110A say it was used to steal credentials.

Who is linked to BlackEnergy?

The US Department of Justice, in an indictment announced 19 October 2020, attributes its use to GRU Unit 74455, tracked as Sandworm. MITRE lists Sandworm Team as a user.

How does BlackEnergy get onto a network?

In the 2015 Ukraine case CISA says it was delivered by spear phishing emails with malicious Microsoft Office attachments. In an earlier campaign CISA reports it on Internet-connected control system screens (HMIs).

How can I check for it?

CISA published a YARA signature in alert ICS-ALERT-14-281-01E and calls it the best method for detecting BlackEnergy infections.

In our research

  1. Sandworm (APT44): Russia’s Most Destructive Cyber Weapon November 2025
  2. Sandworm’s New Arsenal: Kapeka Backdoor Technical Analysis June 2024
  3. Analysis of Hybrid Warfare Through Russia-Ukraine Cyber War March 2022
  4. Sandworm Threat group

Sources

  1. BlackEnergy, Software S0089 MITRE ATT&CKSupports: Toolkit description, start in 2007, variants, plug-ins and techniques.
  2. Ongoing Sophisticated Malware Campaign Compromising ICS (Update E), ICS-ALERT-14-281-01E CISASupports: Campaign since 2011, BlackEnergy 3 in Ukraine, spear phishing vector, YARA signature, mitigations.
  3. Ongoing Sophisticated Malware Campaign Compromising ICS, ICS-ALERT-14-281-01 CISASupports: First alert released to the secure portal on October 8, 2014.
  4. Cyber-Attack Against Ukrainian Critical Infrastructure, IR-ALERT-H-16-056-01 CISASupports: December 23, 2015 outages, BlackEnergy found, role unknown, KillDisk, mitigations, detection.
  5. Indictment, United States v. Andrienko et al. (Military Unit 74455) US Department of JusticeSupports: Unit 74455 is Sandworm; BlackEnergy used to steal credentials; KillDisk; spear phishing.
  6. UK exposes series of Russian cyber attacks against Olympic and Paralympic Games UK Foreign, Commonwealth and Development Office and NCSCSupports: UK lists BlackEnergy, December 2015 among attacks by GRU unit GTsST; DOJ charges on 19 October 2020.
  7. Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure, AA22-110A CISA and partner agenciesSupports: GTsST actors used BlackEnergy and KillDisk in December 2015; awareness and training.
  8. 2015 Ukraine Electric Power Attack, Campaign C0028 MITRE ATT&CKSupports: MITRE campaign using BlackEnergy 3 and KillDisk by Sandworm Team.
  9. Sandworm Team, Group G0034 MITRE ATT&CKSupports: MITRE group page with the BlackEnergy (Group) alias.

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Glossary term

Botnet

A botnet is a group of hijacked internet-connected devices that an attacker controls remotely and uses to carry out large scale attacks.

Read more