A new malware campaign dubbed “GreyEnergy” is targeting information systems tied to critical infrastructure.
Discovered by researchers at ESET spol s.r.o. and reported Wednesday, the campaign is believed to be a successor to the BlackEnergy APT group. The attacks so far are targeting critical infrastructure and are described as a test in preparation for more damaging attacks.
BlackEnergy was a “trojan” virus that was used to conduct distributed denial-of-service attacks, cyberespionage and information destruction attacks back in 2014, primarily in Ukraine.
GreyEnergy is said to share a similar malware framework BlackEnergy and has been designed specifically to target industrial control systems. Like its predecessor, the primary target is again Ukraine, but it has also been detected on similar systems in Poland and other European countries. That means that should it be acted upon, the damage could be widespread.
The attack vector for the malware is currently via two campaigns: spear phishing, or the method of posing as legitimate acquaintances or authorities to fooling people into giving up information, and the targeting of public-facing web servers.
Bob Huber, chief security officer at Tenable Inc., told SiliconANGLE that the news about the GreyEnergy malware campaign is “certainly concerning” but not surprising.
“Will it be the global wake-up call that we’ve been looking for? Maybe,” Huber said. “Since the blackout in Ukraine in December 2015, and likely long before that, advanced adversaries have been stealthily targeting critical infrastructure around the world, learning more and more about the mission-critical systems as they go.”
Huber said each new event is a “canary in the coal mine,” not an isolated incident. “By and large, critical infrastructure owners, operators and stakeholders have made significant strides to secure their systems from outside threats,” he said. “However, additional resources are required to identify and reduce their attack surface.”
Ultimately, Huber added, such persistent threats underscore the importance of visibility across information and operational technology assets. “Blind spots are where advanced adversaries live,” he said. “Shining a light on those areas is key to stopping an attack in its tracks.”
Since you’re here …Support our Sponsors
… We’d like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.
The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.
If you like the reporting, video interviews and other ad-free content here, please take a moment to check out a sample of the video content supported by our sponsors, tweet your support, and keep coming back to SiliconANGLE: