GreyEnergy

GreyEnergy is an advanced threat cluster assessed as a successor to BlackEnergy, also known as Sandworm, and is associated with targeted intrusions against critical infrastructure organizations in Central and Eastern Europe. Activity attributed to GreyEnergy was observed from late 2015 through mid-2018, with a primary focus on Ukraine and additional targeting in Poland and Kazakhstan. The group concentrated on industrial and ICS-adjacent environments, especially energy organizations, as well as transportation and other high-value entities. Its operations were characterized primarily by reconnaissance and espionage, with some evidence of preparatory access that could support later disruptive or destructive activity. GreyEnergy is widely described as one of the post-BlackEnergy subgroups that emerged after the 2015 Ukraine power grid attacks, alongside TeleBots. Reporting has noted code overlap, shared tooling, and operational links between GreyEnergy and TeleBots, including GreyEnergy’s deployment of an early Petya variant known as Moonraker Petya. GreyEnergy has also been linked through shared infrastructure and near-simultaneous victim targeting to Zebrocy, a Sofacy-associated subset, suggesting some degree of relationship or cooperation, although the exact nature of that relationship remains unresolved. Initial access commonly involved spearphishing with malicious documents exploiting vulnerabilities such as CVE-2017-0199 and CVE-2017-11882, as well as compromise of public-facing web services connected to internal networks. GreyEnergy used a lightweight first-stage backdoor known as GreyEnergy Mini, also referred to as FELIXROOT, to profile victims and stage follow-on payloads. The main GreyEnergy malware was modular and supported both fileless, in-memory execution and persistent deployment. Persistence mechanisms included abuse of Windows service DLL loading, while stealth measures included secure wiping of dropped components, encrypted configuration and communications, selective module deployment, forged metadata, and anti-forensic cleanup. Observed post-compromise behavior included extensive host and network reconnaissance, credential theft, keylogging, screenshot capture, exfiltration of system and security information, lateral movement, and establishment of internal proxy command-and-control chains inside victim environments. Operators also used legitimate administrative and offensive tools including Mimikatz, PsExec, WinExe, and Nmap. GreyEnergy malware and infrastructure design showed strong operational security, including use of Tor-relay-backed command-and-control and encrypted communications. Some samples were signed with a likely stolen code-signing certificate from Advantech. Although GreyEnergy was not publicly documented using a dedicated ICS-impact module, it targeted ICS-related systems and at least one deployment included a disk-wiping component.