'Hundreds of computers' in Ukraine hit with wiper malware
(2022/02/24)
- Reference: 1645659873
- News link: https://www.theregister.co.uk/2022/02/23/ukraine_wiper_malware/
- Source link:
Hundreds of computers in Ukraine have been infected with data-wiping Windows malware, say researchers at ESET.
In a [1]series of tweets on Wednesday, the infosec biz said it picked up its first sample of the software nasty at about 1500 UTC, and believes the code has been in the works for the past two months.
"ESET telemetry shows that it was installed on hundreds of machines in the country," the biz stated.
[2]
We're told the data wiper is cryptographically signed with a legit, and presumably stolen, developer certificate to persuade antivirus tools and users to trust it. The malware uses drivers from a partitioning program to corrupt storage devices and destroy files on infected systems, according to ESET.
[3]
[4]
It's not entirely clear right now how the malware is dropped onto victims' machines and run, though in one case, said ESET, an organization's Active Directory server was probably compromised to distribute the wiper through the network via a group policy object.
Symantec's threat intelligence wing [5]also said it had spotted data-trashing malware in Ukraine; the Broadcom-owned biz [6]added it had seen infections in Latvia and Lithuania also.
[7]
ESET dubbed the nasty Win32/KillDisk.NCV. It's understood the code not only wipes files from the drive, it also nukes the MBR, making booting and recovery difficult or impossible thereafter.
[8]Ukraine blames Belarus for PC-wiping 'ransomware' that has no recovery method and nukes target boxen
[9]Cyber-warnings, cyber-speculation over cyber-Iran's cyber-retaliation cyber-plans post-Soleimani assassination
[10]Oil be damned: Iran-based crooks flinging malware at Middle Eastern energy plants again – research
This comes as various Ukrainian websites were [11]disrupted to varying degrees by denial-of-service attacks, and Britain's National Cyber Security Centre warned of a new Kremlin-linked strain of malware that appears to be separate to the wiper ESET and Symantec uncovered.
And the wider context of this is Russia this week invading an area of eastern Ukraine, ostensibly on a peacekeeping mission to protect two separatist regions of Ukraine. That move [12]triggered fresh US sanctions against Moscow.
Russia said it is sending peacekeeping forces into Ukraine.
And presumably this Russian malware is part of its PC-keeping forces [13]https://t.co/4ovf39YTW9 — The Register (@TheRegister) [14]February 23, 2022
Uncle Sam has warned American businesses and organizations to prepare for cyber-attacks from Russia in retaliation for these sanctions and the White House's opposition to Russian President Vladimir Putin's intrusion into Ukraine.
It is feared a full invasion will now follow, as Russia has been amassing troops near Ukraine's border. Ukraine's websites and systems have been targeted and [15]disrupted by miscreants for the past few weeks amid a build up in tensions and breakdown in diplomacy.
A spokesperson for the Consulate General of Ukraine in San Francisco was not available for immediate comment. The entire web presence of the nation's Ministry of Foreign Affairs is offline from a cyber-attack, it appears, we note. ®
Get our [16]Tech Resources
[1] https://twitter.com/ESETresearch/status/1496581903205511181
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YhcQ-ZtOGZ6zu8Id1THHoAAAABc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YhcQ-ZtOGZ6zu8Id1THHoAAAABc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YhcQ-ZtOGZ6zu8Id1THHoAAAABc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://twitter.com/threatintel/status/1496578746014437376
[6] https://www.reuters.com/world/europe/ukrainian-government-foreign-ministry-parliament-websites-down-2022-02-23/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YhcQ-ZtOGZ6zu8Id1THHoAAAABc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2022/01/17/ukraine_pc_wiping_malware_belarus_accusations/
[9] https://www.theregister.com/2020/01/06/iran_attack_speculation/
[10] https://www.theregister.com/2019/12/05/iran_zerocleare_attack/
[11] https://www.theregister.com/2022/02/23/ukraine_ddos_russia_malware/
[12] https://www.theregister.com/2022/02/23/us_sanctions_russia/
[13] https://t.co/4ovf39YTW9
[14] https://twitter.com/TheRegister/status/1496566554280198145?ref_src=twsrc%5Etfw
[15] https://www.theregister.com/2022/02/15/ukraine_cyberattack/
[16] https://whitepapers.theregister.com/
In a [1]series of tweets on Wednesday, the infosec biz said it picked up its first sample of the software nasty at about 1500 UTC, and believes the code has been in the works for the past two months.
"ESET telemetry shows that it was installed on hundreds of machines in the country," the biz stated.
[2]
We're told the data wiper is cryptographically signed with a legit, and presumably stolen, developer certificate to persuade antivirus tools and users to trust it. The malware uses drivers from a partitioning program to corrupt storage devices and destroy files on infected systems, according to ESET.
[3]
[4]
It's not entirely clear right now how the malware is dropped onto victims' machines and run, though in one case, said ESET, an organization's Active Directory server was probably compromised to distribute the wiper through the network via a group policy object.
Symantec's threat intelligence wing [5]also said it had spotted data-trashing malware in Ukraine; the Broadcom-owned biz [6]added it had seen infections in Latvia and Lithuania also.
[7]
ESET dubbed the nasty Win32/KillDisk.NCV. It's understood the code not only wipes files from the drive, it also nukes the MBR, making booting and recovery difficult or impossible thereafter.
[8]Ukraine blames Belarus for PC-wiping 'ransomware' that has no recovery method and nukes target boxen
[9]Cyber-warnings, cyber-speculation over cyber-Iran's cyber-retaliation cyber-plans post-Soleimani assassination
[10]Oil be damned: Iran-based crooks flinging malware at Middle Eastern energy plants again – research
This comes as various Ukrainian websites were [11]disrupted to varying degrees by denial-of-service attacks, and Britain's National Cyber Security Centre warned of a new Kremlin-linked strain of malware that appears to be separate to the wiper ESET and Symantec uncovered.
And the wider context of this is Russia this week invading an area of eastern Ukraine, ostensibly on a peacekeeping mission to protect two separatist regions of Ukraine. That move [12]triggered fresh US sanctions against Moscow.
Russia said it is sending peacekeeping forces into Ukraine.
And presumably this Russian malware is part of its PC-keeping forces [13]https://t.co/4ovf39YTW9 — The Register (@TheRegister) [14]February 23, 2022
Uncle Sam has warned American businesses and organizations to prepare for cyber-attacks from Russia in retaliation for these sanctions and the White House's opposition to Russian President Vladimir Putin's intrusion into Ukraine.
It is feared a full invasion will now follow, as Russia has been amassing troops near Ukraine's border. Ukraine's websites and systems have been targeted and [15]disrupted by miscreants for the past few weeks amid a build up in tensions and breakdown in diplomacy.
A spokesperson for the Consulate General of Ukraine in San Francisco was not available for immediate comment. The entire web presence of the nation's Ministry of Foreign Affairs is offline from a cyber-attack, it appears, we note. ®
Get our [16]Tech Resources
[1] https://twitter.com/ESETresearch/status/1496581903205511181
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YhcQ-ZtOGZ6zu8Id1THHoAAAABc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YhcQ-ZtOGZ6zu8Id1THHoAAAABc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YhcQ-ZtOGZ6zu8Id1THHoAAAABc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://twitter.com/threatintel/status/1496578746014437376
[6] https://www.reuters.com/world/europe/ukrainian-government-foreign-ministry-parliament-websites-down-2022-02-23/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YhcQ-ZtOGZ6zu8Id1THHoAAAABc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2022/01/17/ukraine_pc_wiping_malware_belarus_accusations/
[9] https://www.theregister.com/2020/01/06/iran_attack_speculation/
[10] https://www.theregister.com/2019/12/05/iran_zerocleare_attack/
[11] https://www.theregister.com/2022/02/23/ukraine_ddos_russia_malware/
[12] https://www.theregister.com/2022/02/23/us_sanctions_russia/
[13] https://t.co/4ovf39YTW9
[14] https://twitter.com/TheRegister/status/1496566554280198145?ref_src=twsrc%5Etfw
[15] https://www.theregister.com/2022/02/15/ukraine_cyberattack/
[16] https://whitepapers.theregister.com/
-And so it was - very underwhelming too... everyone waiting for the other shoe to drop.