{"id":47010,"date":"2016-01-14T10:33:30","date_gmt":"2016-01-14T18:33:30","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=47010"},"modified":"2025-06-08T18:24:08","modified_gmt":"2025-06-09T01:24:08","slug":"updated-blackenergy-trojan-grows-more-powerful","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/updated-blackenergy-trojan-grows-more-powerful\/","title":{"rendered":"Updated BlackEnergy Trojan Grows More Powerful"},"content":{"rendered":"

In late December, a cyberattack caused a power outage<\/a> in the Ukraine, plunging hundreds of thousands of citizens into darkness for hours. Threat researchers soon confirmed that the BlackEnergy malware package, first developed in 2007, was the culprit. They also discovered that the malware has been significantly upgraded since its first release.<\/p>\n

The initial BlackEnergy was a simple Trojan with distributed denial of service capabilities. Since then, there have been two upgrades.<\/p>\n

BlackEnergy 2<\/strong><\/h2>\n

In 2010, BlackEnergy 2 appeared. In that development cycle, the authors completely rewrote the code and began to incorporate a more professional approach. For example, they implemented a rudimentary installer that made it simpler to use BlackEnergy.<\/p>\n

With the growth in BlackEnergy 2\u2019s popularity, the authors decided that they needed to add additional features and provide BlackEnergy with a more modular framework. In 2011, they added UAC bypass installers. This method allowed BlackEnergy 2 to gain elevated code execution privileges using the framework Microsoft provides to help legacy applications work with newer versions of Windows. One of BlackEnergy 2\u2019s most impressive features was released in 2013 with the support of 64-bit drivers.<\/p>\n

BlackEnergy 3<\/strong><\/h2>\n

In the second quarter of 2014, F-Secure was the first to report<\/a> a new variant of BlackEnergy. This variant no longer uses many of the features of BlackEnergy 2.<\/p>\n

Each major release has seen an almost complete rewrite of the code. BlackEnergy 3 has more advanced features than its predecessors and is more cleanly developed. The new release does not have a driver, the build ID format is a timestamp, and it has many advanced protection mechanisms. These internal protections include defenses against virtual environments, antidebugging methods, and continued checks throughout the code that will kill the program if it detects other security functions or countermeasures. What stands out about Black Energy 3 are the variety of plug-ins it incorporates:<\/p>\n

BlackEnergy 3 plug-ins*:<\/p>\n