A 12 months of windshield wiper assaults in Ukraine | Shock Tech

This weblog put up presents a compiled overview of the disruptive wiper assaults we now have noticed in Ukraine since early 2022, shortly earlier than the Russian navy invasion started. We had been capable of attribute nearly all of these assaults to Sandworm, with various levels of confidence. The compilation consists of assaults seen by ESET, in addition to some reported by different respected sources equivalent to CERT-UA, Microsoft, and SentinelOne.

Word: Approximate dates (~) are used when the precise implementation date is unsure or unknown. In some instances, the invention date or (within the case of non-ESET discoveries) the assault publication date is used.

pre-invasion

Amongst quite a few waves of DDoS assaults that had focused Ukrainian establishments on the time, WhisperGate malware appeared on January 14.^he2022. The wiper masqueraded as ransomware, echoing NotPetya from June 2017, a tactic that will even be seen in subsequent assaults.

February 23^rdAs of 2022, a damaging marketing campaign utilizing HermeticWiper focused lots of of methods in a minimum of 5 Ukrainian organizations. This draft knowledge was first detected simply earlier than 17:00 native time (15:00 UTC): the cyberattack preceded, by only some hours, the invasion of Ukraine by the forces of the Russian Federation. Together with HermeticWiper, the HermeticWizard worm and HermeticRansom pretend ransomware had been additionally deployed within the marketing campaign.

Invasion and spring wave

February 24^heIn 2022, with the Ukrainian winter about to soften, a second damaging assault in opposition to a Ukrainian authorities community started, utilizing a windshield wiper we now have named IsaacWiper.

Additionally on the day of the invasion, the AcidRain wiper marketing campaign targeted on Viasat KA-SAT modems, additionally spreading exterior Ukraine.

One other cleaner, initially revealed by Microsoft, is DesertBlade, reportedly applied on March 1.^road2022 and once more round March 17^he2022. The identical report additionally mentions Airtight marketing campaign wiper assaults, specifically HermeticWiper (Microsoft calls it FoxBlade) round March 10, 2022, HermeticRansom (Microsoft calls it SonicVote) round March 17^he2022, and an assault round March 24^he2022 with HermeticWiper and HermeticRansom.

CERT-UA reported the invention of the DoubleZero wiper on March 17^he2022.

March 14^he2022, ESET researchers detected an assault utilizing wiper washerwhose goal was a Ukrainian financial institution.

April 1^road, 2022, we detected CaddyWiper once more, this time loaded by the ArguePatch loader, which is often a modified authentic binary used to load shellcode from an exterior file. We detected an analogous situation on Could 16, 2022, the place ArguePatch took the type of a modified ESET binary.

We additionally detected the ArguePatch-CaddyWiper tandem on April 8^he, 2022, in maybe essentially the most bold sandworm assaults because the begin of the invasion: their failed try to disrupt the move of electrical energy utilizing Industroyer2. Along with ArguePatch and CaddyWiper, on this incident we additionally found wipers for non-Home windows platforms: ORCSHRED, SOLOSHRED, and AWFULSHRED. For extra info, see the CERT-UA notification and our WeLiveSecurity weblog put up.

a quieter summer season

The summer season months noticed fewer discoveries of recent wiper campaigns in Ukraine in comparison with earlier months, however a number of notable assaults did happen.

Now we have labored along with CERT-UA on instances of ArguePatch (and CaddyWiper) implementations in opposition to Ukrainian establishments. The primary incident befell within the week of June 20.^he2022, and one other on June 23^rd2022.

autumn wave

With temperatures dropping in preparation for the northern winter, October 3^rd, 2022 we detected a brand new model of CaddyWiper deployed in Ukraine. Not like beforehand used variants, this time CaddyWiper was compiled as a Home windows x64 binary.

fifth of October^he, 2022, we recognized a brand new model of HermeticWiper that had been uploaded to VirusTotal. The performance of this HermeticWiper sampler was the identical as earlier situations, with a number of minor modifications.

on october 11^heFrom 2022, we detected the deployment of Status ransomware in opposition to logistics corporations in Ukraine and Poland. This marketing campaign was additionally reported by Microsoft.

On the identical day, we additionally recognized a beforehand unknown wiper, which we named NikoWiper. This wiper was used in opposition to an organization within the power sector in Ukraine. NikoWiper depends on Microsoft’s SDelete command line utility to securely delete information.

November 11^heIn 2022, CERT-UA revealed a weblog put up about an assault with the pretend Somia ransomware.

on november 21^road2022, we detected in Ukraine a brand new ransomware written in .NET which we name ransomboggs. The ransomware has a number of references to the film Monsters, Inc. We noticed that the malware operators used POWERGAP scripts to implement this file encoder.

January 2023

Disruptive assaults in opposition to Ukrainian establishments proceed in 2023.

January 1st^road2023, we detected the execution of the SDelete utility in a Ukrainian software program reseller.

One other assault with a number of windshield wipers, this time in opposition to a Ukrainian information company, befell on January 17.^he, 2023, in keeping with CERT-UA. The next wipers had been detected on this assault: CaddyWiper, ZeroWipe, SDelete, AwfulShred, and BidSwipe. BidSwipe is price mentioning as it’s a FreeBSD OS cleaner.

January 25^he2023, we detected a brand new wiper, written in Go and referred to as SwiftSlicerthat’s being deployed in opposition to Ukrainian native authorities entities.

In nearly the entire instances talked about above, Sandworm used Lively Listing Group Coverage (T1484.001) to deploy its cleaners and ransomware, particularly utilizing the POWERGAP script.

Conclusion

The usage of disruptive wipers, and even wipers disguised as ransomware, by Russian APT teams, particularly Sandworm, in opposition to Ukrainian organizations is just not new. Since round 2014, BlackEnergy employed disruptive plugins; the KillDisk cleaner was a standard denominator in Sandworm assaults up to now; and the Telebots subgroup have launched quite a few wiper assaults, most infamously NotPetya.

Nonetheless, the intensification of cleanup campaigns because the navy invasion in February 2022 is unprecedented. On a optimistic be aware, most of the assaults have been detected and thwarted. Nonetheless, we proceed to intently monitor the state of affairs as we count on the assaults to proceed.

IoC

information