Hello again! As a follow up to multitude of releases, blog entries and news, we would like to provide more details on the latest BlackEnergy incarnation in Ukraine and how the attacks on Media industry & Electric companies are related, and more over – provide an insight into more indicators of compromise (IOCs). Let us start with saying thanks to all credible cyber experts that investigate the threat and share insights on the attack, some notable names are ESET, CyberX, TrendMicro and iSight. We would focus on ESET’s report as they are providing one of the most comprehensive coverage on BlackEnergy since the days it was first spotted. Now that we have analysis by industry expert on our hands let us take more detailed look at IOC’s and reveal some patterns and perhaps pinpoint a TTP.
Some googling about Ukraine points that BlackEnergy build names may indeed hold some meaning:
Can we conclude that attacks on Ukrainian Media and Electricity providers are related? This would confirm our previous statement that attack on the Media was a Phase 1 of capabilities test: it did some harm but did not disrupt the broadcast. Phase 2 did however disrupt the electricity and we believe more details will follow on shortly. Let us check the fresh IOC’s from ESET and the ones from attack on the media:
We’ll leave conclusions up to you and continue with a very important part that seems to get past most blog posts and articles – the C&C (C2) addresses. These are the current C2 addresses as reported by ESET that remain active as of this article’s writing time:
5.149.254.114
5.9.32.230
31.210.111.154
88.198.25.92
146.0.74.7
188.40.8.72
If we go back in time to 2014 and see ESET video on BlackEnergy 2 we can find the clues we need for TTP from this screenshot of the video:
The cultural references decoded from base64 that refer to Dune were the reason that the attack got pinned on group called “Sandworm” by iSight Partners. Do we have enough to put together whole TTP?
Let us test the model in practice from bottom to the top.
We see that current BlackEnergy attacks use 6 IPv4 C2 addresses and there were 6 C2’s in 2014, only addresses themselves were are different. Tor Relays were used back in 2014. A quick lookup of the new C2 IP’s provide us 1 match based on public Tor relay lists. After some research and threat intel analysis we were able to identify that 5 of 6 C2 address had to be related to Tor relays:
Think about this for a moment. We have same attack tool in use, same amount of C2 IP addresses, Tor is used for APT operations (again) and the same country is attacked, and ICS is attacked (again). One new piece is the KillDisk plugin that has gained some basic AI capabilities: it is able to not just seek & destroy the data it is after but also make decision on the fly, analyzing more than 109 variables and choosing out of 304 functions. We also have new SHA-1 hashes of the drivers different from those ones originally attributed to BlackEnergy 2: are these new builds of same dropper or has it evolved like the plugin? Are we now dealing with APT optimized for FireSale scale attacks to disrupt whole industries? We’d also like to remind that BlackEnergy 3 was mentioned in the past by F-Secure. We leave this question up to the anti-malware specialists with resources and expertise to provide a credible answer. Or perhaps these days BlackEnergy is provided as a packaged Tor-based IaaS available to all who have enough bitcoins to spend ? 😉
Mitigation and proactive detection tips.
Regularly patch your computers and update software, do not open strange email attachments and assure your AV is always up to the date would all seem like a good start. We know for certain that BlackEnergy installs modified drivers that will not load up with modern Windows versions unless it is run in test-mode. Another way of getting those drivers on the system requires a reboot, something that will not fly low under the radar of infosec team. As we already reported BlackEnergy operates based on modified Windows Drivers that are not officially signed, and installation of such drivers requires administrator privileges. Another method of injecting such drivers that was used during the attacks is leveraging a vulnerable version of VirtualBox. As for Proactive detection and timely response we recommend to focus on this:
Finally yet importantly monitoring of Tor activity should be on the priority list of CISO of any Enterprise, MSSP or Public organization, but this is a beginning of yet another story…
Stay safe! /SOC Prime team