Pierluigi Paganini January 16, 2022

Microsoft spotted a new destructive malware operation targeting government, non-profit, and IT entities in Ukraine.

Microsoft spotted a destructive attack that targeted government, non-profit, and IT entities in Ukraine with a wiper disguised as ransomware.

The attackers were discovered by Microsoft on January 13, the experts attributed the attack to an emerging threat cluster tracked as “DEV-0586.” The experts pointed out that the operation has not overlapped with TTPs associated with past campaigns.

“MSTIC assesses that the malware, which is designed to look like ransomware but lacking a ransom recovery mechanism, is intended to be destructive and designed to render targeted devices inoperable rather than to obtain a ransom.” reads the post published by the Microsoft Threat Intelligence Center.

“At present and based on Microsoft visibility, our investigation teams have identified the malware on dozens of impacted systems and that number could grow as our investigation continues.”

However, Reuters in exclusive speculates that the attacks were launched by the Belarus-linked APT group tracked as UNC1151 (aka Ghostwriter).

“Serhiy Demedyuk, deputy secretary of the national security and defence council, told Reuters that Ukraine blamed Friday’s attack – which defaced government websites with threatening messages – on a group known as UNC1151 and that it was cover for more destructive actions behind the scenes.” reported Reuters.

“We believe preliminarily that the group UNC1151 may be involved in this attack,” he said.”

The threat actors targeted government bodies that provide critical executive branch or emergency response functions. At this time, Microsoft experts do not know how many organizations were hit on this campaign. Microsoft experts found dozens of systems hit with the wiper, but warn that the number of infections is expected to increase as the investigation continues.

The attack chain has two stages, in the first phase, the malware overwrites the Master Boot Record to display a faked ransom note that requests the payment of a $10,000 ransomware in bitcoin.

In the second stage, Stage2.exe acts as a downloaded for a malicious file corrupter which is hosted on a Discord channel. The malicious code searches for files with hundreds of different extensions, then overwrites their contents with a fixed number of 0xCC bytes and renames each file with a seemingly random four-byte extension.

According to Microsoft, this activity is inconsistent with cybercriminal ransomware activity:

• Ransomware payloads are typically customized per victim. In this case, the same ransom payload was observed at multiple victims.
• Virtually all ransomware encrypts the contents of files on the filesystem. The malware in this case overwrites the MBR with no mechanism for recovery. 
• Explicit payment amounts and cryptocurrency wallet addresses are rarely specified in modern criminal ransom notes, but were specified by DEV-0586. The same Bitcoin wallet address has been observed across all DEV-0586 intrusions and at the time of analysis, the only activity was a small transfer on January 14.
• It is rare for the communication method to be only a Tox ID, an identifier for use with the Tox encrypted messaging protocol. Typically, there are websites with support forums or multiple methods of contact (including email) to make it easy for the victim to successfully make contact.
• Most criminal ransom notes include a custom ID that a victim is instructed to send in their communications to the attackers. This is an important part of the process where the custom ID maps on the backend of the ransomware operation to a victim-specific decryption key. The ransom note in this case does not include a custom ID.

In the last ours, threat actors have defaced multiple websites of the Ukrainian government on the night between January 13 and January 14. The attacks were launched after talks between Ukrainian, US, and Russian officials hit a dead end on Thursday.The attackers deleted the content of multiple websites, including the Ukrainian Ministry of Foreign Affairs, Ministry of Education and Science, Ministry of Defense, the State Emergency Service, and the Cabinet of Ministers.

Defaced websites were displaying the following message in Russian, Ukrainian and Polish languages.

“Ukrainian! All your personal data has been sent to a public network. All data on your computer is destroyed and cannot be recovered. All information about you stab (public, fairy tale and wait for the worst. It is for you for your past, the future and the future. For Volhynia, OUN UPA, Galicia, Poland and historical areas.” reads a translation of the message.

“Given the scale of the observed intrusions, MSTIC is not able to assess intent of the identified destructive actions but does believe these actions represent an elevated risk to any government agency, non-profit or enterprise located or with systems in Ukraine.” concludes Microsoft. “We strongly encourage all organizations to immediately conduct a thorough investigation and to implement defenses using the information provided in this post. MSTIC will update this blog as we have additional information to share.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, REvil ransomware)

[adrotate banner=”5″]

[adrotate banner=”13″]