BlackEnergy
BlackEnergy (canonical malware naming with generational variants BlackEnergy 1 ~2007 DDoS underground tool + BlackEnergy 2 ~2010-2013 HMI-targeting industrial process capability + BlackEnergy 3 modular plugin architecture used in 2015 Ukraine power grid attack; KillDisk signature wiper companion deployed for restoration-delay amplification) is Sandworm Team's (Russian GRU Unit 74455, also Mandiant APT44 / Microsoft Seashell Blizzard, curated separately as sandworm_team parent operator) signature pre-Industroyer ICS- targeting malware platform, the first publicly acknowledged successful cyberattack on a power grid per the December 23, 2015 Ukraine attack against three energy distribution companies (Prykarpattyaoblenergo most affected with 30 substations switched off including 7×110kV + 23×35kV, ~230,000 customers without electricity 1-6 hours in freezing temperatures, up to 73 MWh not supplied.
alongside Chernivtsioblenergo + Kyivoblenergo)
standalone malware platform cluster paralleling industroyer + notpetya + olympic_destroyer in the Sandworm-platform-family cell.
canonical attribution chain via iSIGHT Partners October 2014 Sandworm Team naming disclosure (Frank Hatheway + John Hultquist + Stephen Ward, Dune-novel references in BlackEnergy malware codebase, CVE-2014-4114 Windows INF/PowerPoint zero-day exploitation targeting Ukrainian government + EU/NATO officials), Mandiant BlackEnergy 3 "calling card" assessment, US Deputy Energy Secretary Elizabeth Sherwood-Randall February 2016 first public US attribution to Russia, Ukrainian government February 2017 formal attribution, US DOJ October 15, 2020 indictment of 6 GRU Unit 74455 officers (Yuriy Sergeyevich Andrienko et al. per MITRE ATT&CK Campaign C0028 reference)
SANS/E-ISAC canonical March 18, 2016 "Analysis of the Cyber Attack on the Ukrainian Power Grid: Defense Use Case" by Robert M. Lee + Michael J. Assante + Tim Conway established canonical Stage 1 access tool (BlackEnergy 3 Office macro spear-phishing) + Stage 2 restoration-delay amplifier (KillDisk wiper) framework with critical clarification "Neither BlackEnergy 3, unreported backdoors, KillDisk, nor the malicious firmware uploads alone were responsible for the outage. Each was simply a component of the cyber attack", actual outage caused by direct adversary interaction with ICS control systems via stolen VPN credentials - RDP-driven circuit breaker manipulation ("the keyboard and mouse of their PCs started moving without human interaction" per Security Boulevard) over ~10-minute attack window; signature tradecraft includes 6+ months pre-positioning reconnaissance via Office macro spear-phishing (employee Excel attachment opening spring 2015 per ISA Lessons Learned), corporate VPN abuse for IT-to-OT pivot, direct interactive RDP session for circuit breaker manipulation, KillDisk Stage 2 restoration-delay tradecraft (MBR corruption + Windows HMI in RTU overwrite), serial-to-Ethernet gateway firmware corruption with random code (substation device destruction), UPS scheduled disconnect via remote management interface (control center recovery interference), telephone denial-of-service against customer call centers (customer recovery interference); also linked to October 2014 Ukrainian elections destructive malware per Mandiant.
TeleBots backdoor framework adjacent signature ESET-disclosed code link to subsequent Industroyer + NotPetya Sandworm-platform- family clusters.
multi-generational platform evolution from criminal DDoS tool to nation-state ICS-targeting modular framework signature pattern.
canonical industry baseline reference for "first publicly acknowledged successful cyberattack on a power grid" cited in essentially all subsequent ICS-targeting cyber- operation industry analyses through 2014-2026 period; Andy Greenberg "Sandworm" book (2019) canonical chronicle.
cluster fills generational predecessor position in Sandworm-platform-family chronology: BlackEnergy 2015 - Industroyer 2016 - NotPetya 2017 - Industroyer2 2022.