GreyEnergy__2018__ESET_GreyEnergy.pdf

ESET's report analyzes the GreyEnergy threat actor and malware family — a modular, sophisticated toolkit used in targeted attacks against critical infrastructure (notably energy and transportation) in Central and Eastern Europe — describing initial infection vectors (spearphishing, compromised web servers), GreyEnergy mini and full backdoor capabilities, persistence and in-memory execution techniques, proxy C2/triungulin infrastructure (often Tor relays), webshells, tools (Mimikatz, PsExec, port scanners), anti-analysis measures, a destructive Moonraker Petya worm variant, and extensive IOCs for detection and mitigation.