Monday, April 15, 2024

CISA and FBI Warn of Destructive Malware to Destroy Ukraine computer Systems

As tension arises between Russia and Ukraine, the CISA (Cybersecurity and Infrastructure Security Agency) has posted that computer systems in Ukraine are being targeted by threat actors as they seek to make systems in the organizations become inoperable.

The Microsoft Threat Intelligence Center (MSTIC) published a disclosure that a malware known by the name “WhisperGate” which is designed and intended to make the system unusable was used against Ukrainian Organizations

Another report from SentinelLabs stated that another malware named “HermeticWiper” was also used for attacking organizations in Ukraine. This malware is specifically designed for Windows systems. It manipulates the master boot records of windows OS subsequently resulting in boot failure.

These kinds of destructive malware can pose a great threat to organizations as they can make critical data and assets unavailable by deleting or encrypting them.

Nevertheless, the attacks on the Ukrainian organizations might accidentally target organizations in other countries. However, Every organization must prepare, plan, detect and respond to an event like that.

The Cybersecurity Advisory (CSA), the CISA, and the Federal bureau have jointly provided complete documentation about recommended guidance and advisory for organizations to prevent WhisperGate and HermeticWiper malware.

Technical Details

The CISA has given a list of campaigns about the malware with an in-depth analysis of the impact. They have also given steps to mitigate them and prevent them from damaging critical infrastructure.

WhisperGate malware contains two stages in which it corrupts the master boot record, provides a fake ransomware note, and encrypts particular files based on their extensions.

Though it displays a ransomware note to pay a ransom, it destroys the data even after paying the ransom. Microsoft also stated that the deleted data is not recoverable making this one of the most sophisticated malware operations.

The HermeticWiper on the other hand targets specifically on windows devices and manipulates the master boot record resulting in a boot failure.

Broadcom stated that HermeticWiper has similar operations to WhisperGate malware. The CISA has also posted Indicators of Compromise and additional information about this malware.

The post urged all organizations to implement the required methods to prevent cyberattacks. Malware that is destructive can be spread by different means that include email campaigns, trojan droppers from websites and so many other methods.

As the malware has the potential to target a large scope of systems, it is necessary for organizations to take necessary preventive measures. The CISA document includes a complete set of necessary measures to mitigate the malware.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Hacker Customize LockBit 3.0 Ransomware to Attack Orgs Worldwide

Cybersecurity researchers at Kaspersky have uncovered evidence that cybercriminal groups are customizing the virulent...

Microsoft .NET, .NET Framework, & Visual Studio Vulnerable To RCE Attacks

A new remote code execution vulnerability has been identified to be affecting multiple Microsoft...

LightSpy Hackers Indian Apple Device Users to Steal Sensitive Data

The revival of the LightSpy malware campaign has been observed, focusing on Indian Apple...

LightSpy Malware Attacking Android and iOS Users

A new malware known as LightSpy has been targeting Android and iOS users.This sophisticated...

This Startup Aims To Simplify End-to-End Cybersecurity, So Anyone Can Do It

The Web3 movement is going from strength to strength with every day that passes....

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles