Meet GreyEnergy, the newest hacking group hitting Ukraine’s power grid

Cybersecurity researchers at ESET have identified a spinoff to the infamous Russian hacking group.

Ever since the seminal cyberattacks on the Ukrainian power grid in 2015 and 2016, researchers have traced the evolution of the broad set of hackers behind the attacks in an effort to warn organizations the hackers might strike next.  On Wednesday, analysts from cybersecurity company ESET added to that body of knowledge in revealing a quieter subgroup of those hackers that has targeted energy companies in Ukraine and Poland.

ESET has dubbed the group GreyEnergy, a derivative of the original group of hackers, which have been known as BlackEnergy. Whereas BlackEnergy is known for the disruptive 2015 attack on the Ukrainian grid that cut power for roughly 225,000 people, GreyEnergy has to date preferred reconnaissance and espionage, according to ESET. The group has taken screenshots of its possible targets, stolen credentials, and exfiltrated files.

“Clearly, they want to fly under the radar,” said Anton Cherepanov, the company’s lead researcher on the case. ESET suspects that BlackEnergy morphed to GreyEnergy at the end of 2015, after the group grabbed the world’s attention in the first known cyberattack to cause a blackout.

Other cybersecurity companies refer to the group behind BlackEnergy as “Sandworm,” an outfit that Western governments have attributed to Russian’s military intelligence directorate. Last week, ESET researchers published evidence – in the form of custom remote access tools – that links 2015 and 2016 hacking operations against the Ukrainian grid with last year’s NotPetya malware outbreak.

“GreyEnergy is an important part of the arsenal of one of the most dangerous APT [advanced persistent threat]  groups that has been terrorizing Ukraine for the past several years,” the new ESET research states, adding “we consider it to be the successor of the BlackEnergy toolkit.”

GreyEnergy’s malware has strong similarities with that of BlackEnergy and another subgroup of the hackers, known as TeleBots, that ESET says was behind the NotPetya incident. According to ESET, GreyEnergy used a “NotPetya-like worm” in December 2016, a tamer precursor to the NotPetya wiper that wreaked global havoc six months later. The worm did not spread beyond a small number of targets, causing less of a splash in the cybersecurity industry, according to ESET. But its similarities with NotPetya suggest that TeleBots and GreyEnergy have collaborated, the researchers  said.

ESET researchers have not seen GreyEnergy use a malware module “capable of affecting” industrial control systems (ICS). That stands in contrast to the ICS-tailored “Industroyer” malware used in the 2016 cyberattack on a power substation in Ukraine. The GreyEnergy hackers have, however, at least once “deployed a disk-wiping component to disrupt operating processes in the affected organization and to cover their tracks,” ESET said.

In an echo of the Stuxnet attack reportedly carried out by the American and Israeli governments on an Iranian nuclear facility, GreyEnergy has apparently used a stolen digital certificate for supply-chain equipment. The certificate was lifted from Advantech, a Taiwanese manufacturer of ICS gear, according to ESET. In Stuxnet’s case, the attackers stole certificates from two hardware companies that were also Taiwanese. The new ESET research is a reminder that APTs sometimes track each other’s activity, learning from and emulating it as they see fit.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure