Pierluigi Paganini
February 24, 2022
The threat of hybrid warfare is reality, Russia-linked APT group have supported the operations of the Russian army while preparing for the invasion.
Researchers from cybersecurity firms ESET and Broadcom’s Symantec discovered a new data wiper malware that was employed in a recent wave of attacks that hit hundreds of machines in Ukraine.
Breaking. #ESETResearch discovered a new data wiper malware used in Ukraine today. ESET telemetry shows that it was installed on hundreds of machines in the country. This follows the DDoS attacks against several Ukrainian websites earlier today 1/n
— ESET Research (@ESETresearch) February 23, 2022
New #wiper malware being used in attacks on #Ukraine
— Threat Intelligence (@threatintel) February 23, 2022
1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591
A tweet from ESET revealed that the company’s telemetry shows the presence of the wiper, tracked as “HermeticWiper” (aka KillDisk.NCV), on hundreds of machines in the country. According to the security firm, the infections followed the DDoS attacks against several Ukrainian websites, including Ministry of Foreign Affairs, Cabinet of Ministers, and Rada.
The first sample of the wiper was observed by ESET yesterday around 14h52 UTC (16h52 local time), but more interesting is the PE compilation timestamp of one of the samples which is 2021-12-28, suggesting that the cyber attack might have been in preparation for almost two months.
The malicious binary was signed using a code signing certificate issued to Hermetica Digital Ltd.
The Wiper binary is signed using a code signing certificate issued to Hermetica Digital Ltd 3/n pic.twitter.com/sGCl3Lbqc1
— ESET Research (@ESETresearch) February 23, 2022
The wiper abuses legitimate drivers from the EaseUS Partition Master software for corrupt data.
In at least one of the targeted organizations, the attackers have taken control of the Active Directory server and dropped via the default Group Policy Object (GPO).
At this time, there is no info to determine the impact of attacks employing the data wiper. Experts did not publicly attribute the attack to Russia, anyway, this is the second wiper that was deployed in a few weeks on Ukrainian computer systems after the WhisperGate.
Yesterday, a new wave of DDoS attacks hit Ukrainian government websites and banks.
“Today, websites of a number of government and banking institutions have undergone a massive DDoS attack again. Some of the attacked information systems are not available or work intermittently. This is due to switching traffic to another provider to minimize damage. Other websites effectively resist the attack and work normally.” reads the alert published by State Service of Special Communications and Information Protection of Ukraine.
“Currently, the State Service of Special Communications and Information Protection of Ukraine and other subjects of the national cybersecurity system are working on countering the attacks, collecting and analyzing information.”
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Ukraine)
[adrotate banner=”5″]
[adrotate banner=”13″]
