BlackEnergy infected also Ukrainian Mining and Railway Systems
13.2.2016 APT

Experts at Trend Micro discovered strains of BlackEnergy malware involved in the recent attacks against Ukrainian Mining and Railway Systems.
BlackEnergy was in the headlines when the security industry examined the power outage occurred in Ukraine in December 2015.

The BlackEnergy malware is a threat improved to target SCADA systems, the latest variant includes the KillDisk component developed to wipe the disks and make systems inoperable.

The Ukrainian government accused Russia of being involved in the attack that caused the power outages, but further analysis revealed that the BlackEnergy malware was not directly responsible for the outages.

Now Trend Micro announced that have spotted BlackEnergy and KillDisk samples on the systems of a Ukrainian mining company and a major railway operator.

The experts noticed that the systems at the mining company were also infected with multiple variants of KillDisk, these samples implements the same features observed in the KillDisk component that infected the power utilities in Ukraine.

The security researchers believe that the threat actors behind them is the same that targeted the Ukrainian power companies.

The researchers noticed many similarities between the samples, naming conventions, control infrastructure, and the timing of the attacks.

TrendMicro spotted several samples similar to the BlackEnergy variant that infected the Ukrainian power utility, the malware used the same command and control (C&C) servers.

“Like the attacks against the Ukrainian mining company, we also witnessed KillDisk possibly being used against a large Ukrainian railway company that is part of the national Ukrainian railway system. The file tsk.exe (SHA1: f3e41eb94c4d72a98cd743bbb02d248f510ad925) was flagged as KillDisk and used in the electric utility attack as well as against the rail company. This appears to be the only spillover from the Ukrainian power utility infection. However, we have no proof showing that BlackEnergy was present on the railway systems, it could be assumed that it was likely present somewhere in their network.” states a blog post published by Trend Micro.

The experts elaborated several theories about the attack, one of the most plausible is the offensive of a politically motivated persistent attacker that intends to hit Ukrainian critical infrastructure to destabilize the country.

“One is that the attackers may have wanted to destabilize Ukraine through a massive or persistent disruption involving power, mining, and transportation facilities,” Wilhoit said. “Another possibility is that they have deployed the malware to different critical infrastructure systems to determine which one is the easiest to infiltrate and subsequently wrestle control over. A related theory is that the infections in the mining and train companies may have just been preliminary infections, where the attackers are just attempting to test the code base.”

Whichever is the case, cyber attacks against critical infrastructures represent a serious threat against any government.