GreyEnergy

MITRE ATT&CK: S0342 View on attack.mitre.org

Aliases: GreyEnergy

First seen
2015-01-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:44:37

Targeted industries: energy-and-utilities government-and-public-sector

Targeted regions: country_code:ua country_code:pl

Context

GreyEnergy is a backdoor written in C and compiled in Visual Studio. GreyEnergy shares similarities with the BlackEnergy malware and is thought to be the successor of it.

Detection coverage

  • 373 Sigma rules

Malware & tools used

  • Multi-hop Proxy (attack-pattern)
  • Rundll32 (attack-pattern)
  • File Deletion (attack-pattern)
  • Windows Service (attack-pattern)
  • Web Protocols (attack-pattern)
  • Code Signing (attack-pattern)
  • System Service Discovery (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Portable Executable Injection (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Modify Registry (attack-pattern)
  • Software Packing (attack-pattern)
  • Keylogging (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • LSASS Memory (attack-pattern)

Used by threat actors

Reports & references

  • MITRE ATT&CK — G0034 (report)
  • eset.com — Greyenergy Exposed (report)
  • secureworks.com — Iron Viking (report)
  • enterprise.verizon.com — 2019 Data Breach Investigations Report (report)
  • blog.nviso.eu — Threat Update Ukraine Russia Tensions (report)
  • ESET — Eset Greyenergy (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Grey Energy (report)
  • Kaspersky — 89506 (report)
  • github.com — Greyenergy Unpacker (report)
  • nozominetworks.com — Greyenergy Malware Research Paper Maldoc To Backdoor (report)
  • MITRE ATT&CK — S0342 (report)

External references