Malware likely cause of power cut in Ukraine

Posted by   Virus Bulletin on   Jan 5, 2016

BlackEnergy malware previously linked to targeted attacks in the country.

When in late December hundreds of thousands of homes in Western Ukraine suffered power outages, many people talked about the possibility of the interruption in power having been caused by a cyber-attack. But people always talk about cyber-attacks — the truth is almost always a lot more mundane.

However, this time things may have been different. ESET's Robert Lipovsky writes that several of the country's energy companies had been targeted by the BlackEnergy trojan around the time of the power cuts, something SCADA expert Robert M. Lee also wrote about, and which the Ukrainian CERT has confirmed to Forbes.

  Excel file with malicious macro used to spread BlackEnergy. Source: ESET.

Robert Lipovsky explains how the trojan used the common methods of spear-phishing and malicious Office macros to infect its targets. After infection, BlackEnergy downloaded a second trojan, KillDisk, which appears to be designed to sabotage industrial systems, and which likely caused the outage.

Of course, it is worth keeping in mind that the power cut may have been an unintended side-effect of another sabotage operation. It is also worth noting that, given the highly polarized situation in Ukraine, any information that comes out of the country will have some kind of bias.

Still, this case shows that despite all the hype and fearmongering, actual cyber-attacks do happen from time to time and that Stuxnet wasn't a one-off incident. It also shows that such attacks don't need to be as advanced and sophisticated as Stuxnet was.

As for the BlackEnergy trojan, it isn't new and is not necessarily used by a single operator. At VB2014 in Seattle, Robert Lipovsky discussed how the trojan was used against various government targets in Ukraine.



Posted on 05 January 2016 by Martijn Grooten
twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Throwback Thursday: Holding the Bady

In 2001, ‘Code Red’ caused White House administrators to change the IP address of the official White House website, and even penetrated Microsoft’s own IIS servers.

Paper: The Journey of Evasion Enters Behavioural Phase

A new paper by FireEye researcher Ankit Anubhav provides an overview of evasion techniques applied by recently discovered malware.

Guest blog: Espionage toolkit uncovered targeting Central and Eastern Europe

Recently, ESET researchers uncovered a new espionage toolkit targeting targeting Central and Eastern Europe. They provide some details in a guest post.

Avast acquires AVG for $1.3bn

Anti-virus vendor Avast has announced the acquisition of its rival AVG for 1.3 billion US dollars.

Throwback Thursday: You Are the Weakest Link, Goodbye!

Passwords have long been a weak point in the security chain, despite efforts to encourage users to pick strong ones. 13 years ago, Martin Overton wrote an article highlighting the weakness and explaining why it is the human element that presents the…