A 12 months of windshield wiper assaults in Ukraine | Shock Tech

virtually A 12 months of windshield wiper assaults in Ukraine

will cowl the newest and most present help re the world. open slowly appropriately you comprehend competently and accurately. will buildup your data easily and reliably


ESET Analysis compiled a timeline of cyberattacks utilizing cleanup malware that occurred because the Russian invasion of Ukraine in 2022

This weblog put up presents a compiled overview of the disruptive wiper assaults we now have noticed in Ukraine since early 2022, shortly earlier than the Russian navy invasion started. We had been capable of attribute nearly all of these assaults to Sandworm, with various levels of confidence. The compilation consists of assaults seen by ESET, in addition to some reported by different respected sources equivalent to CERT-UA, Microsoft, and SentinelOne.

ESET Research Destructive malware targeting Ukrainian organizations IsaacWiper and HermeticWizard: New wiper and worm targeting Ukraine AcidRain | A Modem Wiper Rains Down on Europe IsaacWiper and HermeticWizard: New wiper and worm targeting Ukraine An overview of Russia’s cyberattack activity in Ukraine An overview of Russia’s cyberattack activity in Ukraine ESET Research CERT-UA An overview of Russia’s cyberattack activity in Ukraine An overview of Russia’s cyberattack activity in Ukraine An overview of Russia’s cyberattack activity in Ukraine ESET APT ACTIVITY REPORT T2 2022 Industroyer2: Industroyer reloaded CERT-UA ESET Research ESET Research ESET APT ACTIVITY REPORT T2 2022 ESET APT ACTIVITY REPORT T3 2022 ESET APT ACTIVITY REPORT T3 2022 ESET APT ACTIVITY REPORT T3 2022 New “Prestige” ransomware impacts organizations in Ukraine and Poland ESET APT ACTIVITY REPORT T3 2022 CERT-UA RansomBoggs: New ransomware targeting Ukraine CERT-UA SwiftSlicer: New destructive wiper malware strikes Ukraine

Word: Approximate dates (~) are used when the precise implementation date is unsure or unknown. In some instances, the invention date or (within the case of non-ESET discoveries) the assault publication date is used.


Amongst quite a few waves of DDoS assaults that had focused Ukrainian establishments on the time, WhisperGate malware appeared on January 14.he2022. The wiper masqueraded as ransomware, echoing NotPetya from June 2017, a tactic that will even be seen in subsequent assaults.

February 23rdAs of 2022, a damaging marketing campaign utilizing HermeticWiper focused lots of of methods in a minimum of 5 Ukrainian organizations. This draft knowledge was first detected simply earlier than 17:00 native time (15:00 UTC): the cyberattack preceded, by only some hours, the invasion of Ukraine by the forces of the Russian Federation. Together with HermeticWiper, the HermeticWizard worm and HermeticRansom pretend ransomware had been additionally deployed within the marketing campaign.

Invasion and spring wave

February 24heIn 2022, with the Ukrainian winter about to soften, a second damaging assault in opposition to a Ukrainian authorities community started, utilizing a windshield wiper we now have named IsaacWiper.

Additionally on the day of the invasion, the AcidRain wiper marketing campaign targeted on Viasat KA-SAT modems, additionally spreading exterior Ukraine.

One other cleaner, initially revealed by Microsoft, is DesertBlade, reportedly applied on March 1.road2022 and once more round March 17he2022. The identical report additionally mentions Airtight marketing campaign wiper assaults, specifically HermeticWiper (Microsoft calls it FoxBlade) round March 10, 2022, HermeticRansom (Microsoft calls it SonicVote) round March 17he2022, and an assault round March 24he2022 with HermeticWiper and HermeticRansom.

CERT-UA reported the invention of the DoubleZero wiper on March 17he2022.

March 14he2022, ESET researchers detected an assault utilizing wiper washerwhose goal was a Ukrainian financial institution.

April 1road, 2022, we detected CaddyWiper once more, this time loaded by the ArguePatch loader, which is often a modified authentic binary used to load shellcode from an exterior file. We detected an analogous situation on Could 16, 2022, the place ArguePatch took the type of a modified ESET binary.

We additionally detected the ArguePatch-CaddyWiper tandem on April 8he, 2022, in maybe essentially the most bold sandworm assaults because the begin of the invasion: their failed try to disrupt the move of electrical energy utilizing Industroyer2. Along with ArguePatch and CaddyWiper, on this incident we additionally found wipers for non-Home windows platforms: ORCSHRED, SOLOSHRED, and AWFULSHRED. For extra info, see the CERT-UA notification and our WeLiveSecurity weblog put up.

a quieter summer season

The summer season months noticed fewer discoveries of recent wiper campaigns in Ukraine in comparison with earlier months, however a number of notable assaults did happen.

Now we have labored along with CERT-UA on instances of ArguePatch (and CaddyWiper) implementations in opposition to Ukrainian establishments. The primary incident befell within the week of June 20.he2022, and one other on June 23rd2022.

autumn wave

With temperatures dropping in preparation for the northern winter, October 3rd, 2022 we detected a brand new model of CaddyWiper deployed in Ukraine. Not like beforehand used variants, this time CaddyWiper was compiled as a Home windows x64 binary.

fifth of Octoberhe, 2022, we recognized a brand new model of HermeticWiper that had been uploaded to VirusTotal. The performance of this HermeticWiper sampler was the identical as earlier situations, with a number of minor modifications.

on october 11heFrom 2022, we detected the deployment of Status ransomware in opposition to logistics corporations in Ukraine and Poland. This marketing campaign was additionally reported by Microsoft.

On the identical day, we additionally recognized a beforehand unknown wiper, which we named NikoWiper. This wiper was used in opposition to an organization within the power sector in Ukraine. NikoWiper depends on Microsoft’s SDelete command line utility to securely delete information.

November 11heIn 2022, CERT-UA revealed a weblog put up about an assault with the pretend Somia ransomware.

on november 21road2022, we detected in Ukraine a brand new ransomware written in .NET which we name ransomboggs. The ransomware has a number of references to the film Monsters, Inc. We noticed that the malware operators used POWERGAP scripts to implement this file encoder.

January 2023

Disruptive assaults in opposition to Ukrainian establishments proceed in 2023.

January 1stroad2023, we detected the execution of the SDelete utility in a Ukrainian software program reseller.

One other assault with a number of windshield wipers, this time in opposition to a Ukrainian information company, befell on January 17.he, 2023, in keeping with CERT-UA. The next wipers had been detected on this assault: CaddyWiper, ZeroWipe, SDelete, AwfulShred, and BidSwipe. BidSwipe is price mentioning as it’s a FreeBSD OS cleaner.

January 25he2023, we detected a brand new wiper, written in Go and referred to as SwiftSlicerthat’s being deployed in opposition to Ukrainian native authorities entities.

In nearly the entire instances talked about above, Sandworm used Lively Listing Group Coverage (T1484.001) to deploy its cleaners and ransomware, particularly utilizing the POWERGAP script.


The usage of disruptive wipers, and even wipers disguised as ransomware, by Russian APT teams, particularly Sandworm, in opposition to Ukrainian organizations is just not new. Since round 2014, BlackEnergy employed disruptive plugins; the KillDisk cleaner was a standard denominator in Sandworm assaults up to now; and the Telebots subgroup have launched quite a few wiper assaults, most infamously NotPetya.

Nonetheless, the intensification of cleanup campaigns because the navy invasion in February 2022 is unprecedented. On a optimistic be aware, most of the assaults have been detected and thwarted. Nonetheless, we proceed to intently monitor the state of affairs as we count on the assaults to proceed.

In case you have any questions on our analysis revealed on WeLiveSecurity, please contact us at [email protected]

ESET Analysis additionally provides non-public APT intelligence experiences and knowledge feeds. For any questions on this service, go to the ESET Menace Intelligence web page



SHA-1 file identify ESET detection identify Description
189166D382C73C242BA45889D57980548D4BA37E stage1.exe Win32/KillMBR.NGI WhisperGate Stage 1 MBR Overwriter.
A67205DC84EC29EB71BB259B19C1A1783865C0FC N/A Win32/KillFiles.NKU WhisperGate stage 2 closing payload.
912342F1C840A42F6B74132F8A7C4FFE7D40FB77 com.exe Win32/KillDisk.NCV Airtight Wiper.
61B25D11392172E587D8DA3045812A66C3385451 conhosts.exe Win32/KillDisk.NCV Airtight Wiper.
F32D791EC9E6385A91B45942C230F52AFF1626DF cc2.exe WinGo/Filecoder.BK Airtight Ransom.
86906B140B019FDEDAABA73948D0C8F96A6B1B42 ukrop Linux/AcidRain.A Acid rain.
AD602039C6F0237D4A997D5640E92CE5E2B3BBA3 cl64.dll Win32/KillMBR.NHP Isaac Wiper.
736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950 cld.dll Win32/KillMBR.NHQ Isaac Wiper.
E9B96E9B86FAD28D950CA428879168E0894D854F clear.exe Win32/KillMBR.NHP Isaac Wiper.
5C01947A49280CE98FB39D0B72311B47C47BC5CC clear.exe Win32/KillMBR.NHP Isaac Wiper.
59F5B9AECE751E58BE16E7F7A7A6D8C044F583BE cll.exe Win32/KillMBR.NHQ Isaac Wiper.
172FBE91867C1D6B7F3E2899CEA69113BB1F21A0 notes.exe WinGo/KillFiles.A Desert Blade wiper blades.
46671348C1A61B3A8BFBA025E64E5549B7FDFA98 N/A Win32/KillDisk.NCV Airtight Wiper.
DB0DA0D92D90657EA91C02336E0605E96DB92C05 clrs.exe Win32/KillDisk.NCV Airtight Wiper.
98B3FB74B3E8B3F9B05A82473551C5A77B576D54 caddy.exe Win32/KillDisk.NCX Caddy Wiper.
320116162D78AFB8E00FD972591479A899D3DFEE cpcrs.exe MSIL/KillFiles.CK DoubleZero windshield wipers.
43B3D5FFAE55116C68C504339C5D953CA25C0E3F csrss.exe MSIL/KillFiles.CK DoubleZero windshield wipers.
48F54A1D93C912ADF36C79BB56018DEFF190A35C ukcphone.exe Win32/Agent.AECG ArguePatch shellcode loader.
6FA04992C0624C7AA3CA80DA6A30E6DE91226A16 peremoga.exe Win32/Agent.AECG ArguePatch shellcode loader.
9CE1491CE69809F92AE1FE8D4C0783BD1D11FBE7 pa1.pay Win32/KillDisk.NDA Shellcode CaddyWiper encrypted.
3CDBC19BC4F12D8D00B81380F7A2504D08074C15 wobf.sh Linux/KillFiles.C AwfulShred Linux Cleaner.
8FC7646FA14667D07E3110FE754F61A78CFDE6BC wsol.sh Linux/KillFiles.B SoloShred Solaris wipe.
796362BD0304E305AD120576B6A8FB6721108752 eset_ssl_filtered_cert_importer.exe Win32/Agent.AEGY ArguePatch shellcode loader.
8F3830CB2B93C21818FDBFCF526A027601277F9B spn.exe Win32/Agent.AEKA ArguePatch shellcode loader.
3D5C2E1B792F690FBCF05441DF179A3A48888618 mslrss.exe Win32/Agent.AEKA ArguePatch shellcode loader.
EB437FF79E639742EE36E89F30C6A21072B86CBC caclcly.exe Win64/Agent.BQZ Caddy Wiper x64.
57E3D0108636F6EE56C801F128306AD43AF60EE6 cmrss.exe Win32/KillDisk.NCV Airtight Wiper.
986BA7A5714AD5B0DE0D040D1C066389BCB81A67 open.exe Win32/Filecoder.Status.A Status file encoder.
C7186DEF5E9C3E1B01BF506F538F5D6185377A9C sysate32.exe Win32/Filecoder.Status.A Status file encoder.
59621F5EFC311FDFE66683266CE9CB17F8227B23 mstc_niko.exe Win32/DelAll.NAH Niko Wiper.
84E6A010B372D845C723A8B8D7DDD8D79675DCE5 Sullivan.1.v2.0.exe MSIL/Filecoder.RansomBoggs.A RansomBoggs File Encoder.
F4D1C047923B9D10031BB709AABF1A250AB0AAA2 Sullivan.1.v4.5.exe MSIL/Filecoder.RansomBoggs.A RansomBoggs File Encoder.
9A3D63C6E127243B3036BC0E242789EC1D2AB171 Sullivan.2.v2.exe MSIL/Filecoder.RansomBoggs.A RansomBoggs File Encoder.
BB187EB125070176BD7EC6C57CFF166708DD60E1 Sullivan.2.v4.exe MSIL/Filecoder.RansomBoggs.A RansomBoggs File Encoder.
3D593A39FA20FED851B9BEFB4FF2D391B43BDF08 Sullivan.v2.5.exe MSIL/Filecoder.RansomBoggs.A RansomBoggs File Encoder.
021308C361C8DE7C38EF135BC3B53439EB4DA0B4 Sullivan.v4.5.exe MSIL/Filecoder.RansomBoggs.A RansomBoggs File Encoder.
7346E2E29FADDD63AE5C610C07ACAB46B2B1B176 assist.exe WinGo/KillFiles.C SwiftSlicer wiper.

I hope the article not fairly A 12 months of windshield wiper assaults in Ukraine

provides sharpness to you and is beneficial for additional to your data

A year of windshield wiper attacks in Ukraine

Leave a Reply