GreyEnergy is an advanced persistent threat (APT) group that emerged around December 2015, acting as a successor to the BlackEnergy APT group, with its activity coinciding with BlackEnergy's operational decline. The group is assessed with high confidence to be of Russian origin, with strong connections to Russia's GRU. Its primary motivation is espionage and reconnaissance, often conducted in preparation for potential future cyber-sabotage attacks against critical infrastructure. What distinguishes GreyEnergy is its highly modular malware framework designed for stealth, employing partially encrypted and fileless modules that reside only in memory, and securely wiping malware components from hard drives to impede analysis and detection. The group also utilizes Tor relays for command and control communications. GreyEnergy is distinct from but closely related to both the BlackEnergy and TeleBots groups.

Aliases del actor

APT GREYENERGYMaldocGreyEnergy DropperGreyEnergy MinFELIXROOTincluyendo el desarrollodistribución de herramientas maliciosas

Actores similares

apt-greyenergyactor · 1greyenergy-miniactor · 1greyenergy-groupactor · 1apt-leafmineractor · 1apt-luminousmothactor · 1apt-minidukeactor · 1apt-45actor · 2apt-c-27actor · 2apt-c-01actor · 2apt-c-12actor · 1