From Russia With Malware: "Boris" and "Natasha"

Wapack Labs research has revealed an association between the author of the BlackEnergy malware and ZORSecurity: one of the Russian companies sanctioned by the U.S. government in retaliation for Russian interference in the U.S. Presidential election. ZORSecurity CEO Alisa Shevchenko denies any involvement with these attacks or connections to Russian intelligence services. Dmytry Oleksyuk has been an employee of ZORSecurity for several years, and has acknowledged his involvement in creating BlackEnergy 1.X, which was used to DDoS Georgia during the 2008 war with Russia.

A more detailed report on these links can be found in the Red Sky portal. If you would like us to continue to monitor this relationship, click this link and hit send and we’ll notify you of any significant developments.

TLP: AMBER
ACTOR TYPE: (IV)
SERIAL: TR-037-2017
COUNTRIES: RU, U.S.
INDUSTRIES: Political, Governmental
REPORT DATE: 20170217