Various reports have been published that analyze BlackEnergy2 and BlackEnergy3 in-depth. However, there seems to be discrepancies regarding the malware delivery phase, i.e., initial exploitation.
The CrashOverride report published by Dragos describes the BlackEnergy2 malware as follows:
This ICS tailored malware contained exploits for specific types of HMI applications including Siemens SIMATIC, GE CIMPLICITY, and Advantech WebAccess. BLACKENERGY 2 was a smart approach by the adversaries to target internet connected HMIs.
The ICS-ALERT-14-281-01E alert issued by ICS-CERT regarding BlackEnegery3 seems to confirm this:
In a departure from the ICS product vulnerabilities used to deliver the BE2 malware, in this case the infection vector appears to have been spear phishing via a malicious Microsoft Office (MS Word) attachment.
However, there are various sources that indicate that BlackEnergy3 includes ICS-specific exploits targeting HMIs(, instead of BlackEnergy2).
The main attack vector observed was infection of Human-Machine-Interface (HMI) machines in ICS networks. These machines provide a user interface for interacting and controlling industrial networks. According to the alert issued by ICS-CERT, various vendors were targeted, including GE CIMPLICITY, Advantech/Broadwin WebAccess, and Siemens WinCC.
According to , all BlackEnergy3 malware used for targeted attacks infect the Human-Machine-Interface (HMI) workstations in ICS plant networks.
BE3 was also found scanning the internet for a specific HMI, the GE Intelligent Platforms HMI/SCADA - CIMPLICITY. The HMI was known to have a directory traversal vulnerability in CimWebServer.exe (the WebView component) which allows remote attackers to execute arbitrary code via a crafted message to TCP port 10212, (ZDI-CAN-1623).
What am I missing here?