ESET has reported that GreyEnergy is the successor to the BlackEnergy malware. I don't think there's enough data in the report to independently verify this. Note that victim overlaps are heavily considered. 1/n
welivesecurity.com/2018/10/17/gre…
welivesecurity.com/2018/10/17/gre…
I don't think you can make much out of the disappearance of BE in the wild. AV vendors, like ESET, were getting good at catching it. The fact that other malware showed up as the use of BE was winding down is not itself a connection. 2/n
There's also a note that GreyEnergy has been seen targeting ICS networks. But what does that really mean? It doesn't mean that it's dedicated to ICS. ICS networks are cyber key terrain for nation state hackers and it looks like GreyEnergy is a nation state tool. 3/n
But we should be careful to not call GreyEnergy ICS malware. It's not. Any malware could be used to target ICS systems. That GreyEnergy has been used doesn't make it ICS malware any more than netcat is ICS malware. 4/n
For the record, it very well could be that GreyEnergy is a successor to BlackEnergy. The code overlap is not really compelling because lots of BE code has been leaked repeatedly. The report is good, but we should caution ICS operators not to jump to conclusions. 5/5
