BlackEnergy

What is BlackEnergy?

BlackEnergy is a modular Windows malware family that dates back to 2007, started as a toolkit for DDoS botnets and grew into the access tool used by the Russian group Sandworm in the cyber attack on the Ukrainian power grid of 23 December 2015. In that attack, roughly 225,000 customers of three regional distribution companies lost power for 1 to 6 hours: the first publicly confirmed power outage caused by a cyber attack. BlackEnergy itself did not open any breakers; it gave the attackers access and credentials, after which they manually tripped circuit breakers through the existing SCADA software. That made BlackEnergy the textbook example of an attack that starts in IT and causes physical damage in OT, and a turning point in industrial cybersecurity.

🕰️ How did BlackEnergy evolve?

BlackEnergy went through three generations, shifting steadily from a criminal tool towards espionage and sabotage:

MITRE ATT&CK lists BlackEnergy as software S0089, linked to Sandworm Team (G0034) and the campaign “2015 Ukraine Electric Power Attack” (C0028). MITRE ATT&CK for ICS maps the techniques of that campaign, from spearphishing to switching off UPS units.

🖥️ What role did BlackEnergy play in OT before 2015?

In October 2014 the US ICS-CERT (now part of CISA) warned that BlackEnergy had been used since at least 2011 against industrial HMI software. The campaign targeted:

• GE CIMPLICITY - through vulnerability CVE-2014-0751 on HMIs connected directly to the internet
• Advantech/Broadwin WebAccess - also often reachable directly from the internet
• Siemens WinCC - with indications that a since-patched vulnerability was exploited

At that time ICS-CERT found no attempts to disrupt processes. The lesson was nevertheless clear, and typical of OT convergence: the attackers were reconnoitring ICS environments years before they struck. Internet-exposed HMIs were the first way in.

⚡ What happened on 23 December 2015?

On 23 December 2015, dozens of substations operated by three Ukrainian distribution companies (oblenergos), Prykarpattyaoblenergo, Kyivoblenergo and Chernivtsioblenergo, went offline within half an hour. The companies had to switch to manual operation. The attack had been prepared for months:

1. Initial access through spearphishing - from spring 2015, staff received emails with Office attachments whose macros installed BlackEnergy 3.
2. Reconnaissance and credential theft - the attackers moved through the office network, took over the Active Directory and harvested domain and VPN accounts.
3. Lateral movement into OT - using legitimate accounts, they logged in over the VPN to the distribution SCADA network, which was poorly separated from office IT.
4. Switching through the HMI - operators watched their mouse cursor move while the attackers used remote access and existing SCADA clients to open circuit breakers in substations.
5. Sabotaging recovery - the firmware of serial-to-Ethernet converters in substations was overwritten so they could no longer be reached remotely; the UPS units of servers were switched off through their management interface.
6. Wiping traces - the KillDisk wiper erased files and the master boot record of workstations and servers, including Windows-based HMIs in RTUs.
7. Blocking customer contact - a telephone denial-of-service flooded the call centre so customers could not report outages.

The US E-ISAC and SANS published the best-known analysis of the incident on 18 March 2016. In October 2020 the US Department of Justice indicted six officers of GRU unit 74455 (Sandworm), partly for this attack.

🧠 Why was the abuse of legitimate functions, not the malware, the real problem?

The most striking aspect of the attack is that no exotic ICS malware was needed. BlackEnergy was found at all three distribution companies, but according to ICS-CERT no specific BlackEnergy capabilities were used to cut the power. The attackers did what any operator can do: log in, select a substation and open a breaker.

This sets BlackEnergy apart from Stuxnet or Industroyer: the malware was an IT tool, while the sabotage was carried out by hand through the existing SCADA software and RTUs, without any custom code on PLCs or RTUs.

🔄 What is the difference between BlackEnergy and Industroyer?

A year later, on 17 December 2016, Sandworm struck Ukraine again, this time with Industroyer against the Pivnichna substation near Kyiv.

Both attacks show that critical infrastructure is an active target. In 2017 Sandworm also unleashed NotPetya, causing damage worldwide.

🔐 How do you protect your OT environment against a BlackEnergy-style attack?

The measures from the 2016 ICS-CERT alert are still the core of Defense in Depth:

• Separate IT and OT - network segmentation following the Purdue Model and the Zones and Conduits Model from IEC 62443, with an industrial firewall or a data diode for one-way traffic.
• Restrict remote access - no persistent vendor connections, access only on request and time-limited, always with MFA and through a jump server.
• Separate identities - no domain trust between office AD and OT; Zero Trust principles for administrator accounts.
• Application Whitelisting - especially on HMIs, engineering stations and servers with a fixed configuration.
• Monitoring - integration of IT and OT security with OT monitoring and an IDS that spot new VPN sessions, unusual switching commands and firmware uploads, linked to a SIEM. Platforms such as Claroty, Nozomi and Dragos focus on exactly this.
• Recoverability - offline backups of servers and configurations, spare converters and a rehearsed playbook for manual operation.
• OT-aware incident response - in OT you often cannot simply shut systems down, because physical processes keep running and safety comes first; agree in advance who may isolate what and when, with operations, engineering, IT security and the SOC involved.

Dutch and European context

In the Netherlands the Cyberbeveiligingswet (Cybersecurity Act), the transposition of NIS2 that entered into force on 15 August 2026, imposes a duty of care and incident reporting on grid operators and other essential entities. The BlackEnergy attack is a standard scenario in risk assessments based on NIST SP 800-82 and IEC 62443; in North America it drew extra attention to NERC CIP. An organisation certified to ISO 27001 should include such OT scenarios explicitly in its risk assessment.

🧪 What does a BlackEnergy resilience check look like?

A regional grid operator or drinking water company can check in five steps whether an attack like the one in 2015 would succeed against it:

1. Follow the path - can a compromised office workstation reach SCADA directly through VPN, shared accounts or AD?
2. Inventory remote access - which VPNs and vendor connections exist, and do all of them use MFA?
3. Check management interfaces - are UPS units, converters and switches reachable only from a management zone, with segmentation between office, OT and management?
4. Test recovery - can the organisation run for a day on manual operation and restore HMIs from backups?
5. Exercise - run a tabletop exercise with operations, engineering and the incident response team based on the 2015 scenario.

❓ Frequently asked questions

Is BlackEnergy a virus for PLCs?

No, BlackEnergy is Windows malware that runs on office computers, servers and HMIs, not on PLCs or RTUs. In the 2015 attack, BlackEnergy gave the attackers access and credentials, after which they manually tripped the circuit breakers through the existing SCADA software.

Who is behind BlackEnergy?

BlackEnergy 1 was sold as a criminal DDoS toolkit in 2007. The later BlackEnergy 3 attacks on Ukraine are attributed to Sandworm, unit 74455 of Russia’s GRU military intelligence service, which the United States formally indicted in 2020.

How many people were affected by the BlackEnergy attack?

In the BlackEnergy attack of 23 December 2015, about 225,000 customers of three Ukrainian distribution companies were without power for 1 to 6 hours. The companies continued to rely partly on manual operation for months afterwards, because substation equipment had been rendered unusable.

What is KillDisk?

KillDisk is a wiper that destroys files and the master boot record of Windows systems. In the 2015 BlackEnergy attack, KillDisk was used after the switching to make workstations, servers and HMIs unusable and to slow down recovery.

Is BlackEnergy still active?

BlackEnergy itself plays hardly any role in recent attacks; Sandworm moved on to Industroyer, NotPetya and later wipers. The method of the BlackEnergy attack, phishing, stolen accounts and abuse of legitimate OT software, is however still highly relevant.

Which measure helps most against a BlackEnergy-style attack?

Against a BlackEnergy-style attack, strict separation between IT and OT combined with MFA on all remote access helps most. Without direct VPN access using stolen domain accounts, the 2015 attackers could not have reached the SCADA environment so easily.

📌 In summary

BlackEnergy is the malware that in 2015 opened the door to the first confirmed power outage caused by a cyber attack, leaving about 225,000 Ukrainian customers without electricity. The malware itself mainly stole access and credentials; the actual sabotage was done through legitimate VPN and SCADA functions. To defend against this, you separate IT and OT strictly, secure remote access with MFA, monitor operations and firmware, and make sure you can fall back on manual operation and offline backups during an attack.