Ransomware was used as a decoy in some of the recent data-wiping cyberattacks against organizations in Ukraine, Symantec reports.
The cyberattacks employed HermeticWiper, a piece of malware that was designed solely to damage the Master Boot Record (MBR) of the target system, rendering the machine unusable.
Once executed, the wiper adjusts its settings to gain read access control to any file, then gains the privileges required to load and unload device drivers, disables crash dumps to cover its tracks, disables the Volume Shadow Service (VSS), and loads a benign partition manager which it abuses to corrupt the MBR.
The wiper uses different corruption methods based on the version of Windows running on the machine and partition type (FAT or NTFS). HermeticWiper can damage both MBR and GPT drives and triggers a system reboot to complete the data wiping process, researchers with Cisco’s Talos division note.
Although executed on February 23, hours before Russia launched an invasion of Ukraine, the attacks appear to have been in preparation for months.
The network of one organization in Ukraine was compromised on December 23, 2021, with a web shell installed on January 16, more than one month before HermeticWiper was deployed, Symantec reports.
[ READ: Russia, Ukraine and the Danger of a Global Cyberwar ]
The cybersecurity firm has also found evidence that the wiper was used in attacks against computers in Lithuania as well. At least one organization in the country fell victim to HermeticWiper, after the attackers compromised its network and achieved persistence in November 2021.
In both attacks, the threat actors behind the wiper stole credentials found in the compromised environments and executed the wiper using scheduled tasks.
Similar to the WhisperGate cyberattacks on Ukraine, some of the HermeticWiper incidents involved the execution of ransomware on the infected machines. However, Symantec believes that the ransomware was only employed as a distraction from the destructive data-wiping attacks.
Despite their destructive capabilities and similarities in targeting and behavior, WhisperGate and HermeticWiper do not show code overlaps, IBM Security X-Force researchers say.
Both IBM and Symantec warn that the developing situation in Ukraine is expected to be accompanied by more destructive cyberattacks, potentially escalating in parallel with the ongoing conflict.
Related: Destructive ‘HermeticWiper’ Malware Targets Computers in Ukraine
Related: Cyberattacks Accompany Russian Military Assault on Ukraine
Related: New ‘Cyclops Blink’ Malware Linked to Russian State Hackers Targets Firewalls
More from Ionut Arghire
- Google Shells Out $600,000 for OSS-Fuzz Project Integrations
- F5 BIG-IP Vulnerability Can Lead to DoS, Code Execution
- Flaw in Cisco Industrial Appliances Allows Malicious Code to Persist Across Reboots
- HeadCrab Botnet Ensnares 1,200 Redis Servers for Cryptomining
- Malicious NPM, PyPI Packages Stealing User Information
- Boxx Insurance Raises $14.4 Million in Series B Funding
- Prilex PoS Malware Blocks NFC Transactions to Steal Credit Card Data
- 30k Internet-Exposed QNAP NAS Devices Affected by Recent Vulnerability
Latest News
- Google Shells Out $600,000 for OSS-Fuzz Project Integrations
- F5 BIG-IP Vulnerability Can Lead to DoS, Code Execution
- Flaw in Cisco Industrial Appliances Allows Malicious Code to Persist Across Reboots
- UK Car Retailer Arnold Clark Hit by Ransomware
- Dealing With the Carcinization of Security
- HeadCrab Botnet Ensnares 1,200 Redis Servers for Cryptomining
- Cyber Insights 2023 | Supply Chain Security
- Cyber Insights 2023 | Regulations
