Ukraine energy and media industry hit by “Russian” malware

Cyber criminals responsible for the trojan known as BlackEnergy made a return last year, with attacks on Ukraine-based energy and media firms, say information security researchers.

It is believed that the malware comes from Russia, due to it being used on industrial control systems and politically strategic targets.

Eset said that BlackEnergy was inactive in late 2014, but made a comeback at the end of 2015. The latest version of the malware features an additional component (KillDisk) which has been used in attacks on Ukrainian electric power systems and news media companies.

The new component sees the malware writing over files on infected systems, resulting in an inability for the user to boot the OS.

Eset’s Anton Cherepanov posted on a blog stating that last November saw the first case of KillDisk being used. He added:

“In that instance, a number of news media companies were attacked at the time of the 2015 Ukrainian local elections. The report claims that a large number of video materials and various documents were destroyed as a result of the attack.”

The malware can overwrite over 4,000 file types.

Cyber warfare seems as though it could take centre stage in global affairs in the near future, but it isn’t just governments who are being targeted by professional cyber criminals. Businesses need to be on guard when it comes to potential cyber attacks, so prioritising their IT security recruitment strategy would be the common sense first step in doing just that.