Saturday, December 2, 2023

CISA and FBI Warn of Destructive Malware to Destroy Ukraine computer Systems

As tension arises between Russia and Ukraine, the CISA (Cybersecurity and Infrastructure Security Agency) has posted that computer systems in Ukraine are being targeted by threat actors as they seek to make systems in the organizations become inoperable.

The Microsoft Threat Intelligence Center (MSTIC) published a disclosure that a malware known by the name “WhisperGate” which is designed and intended to make the system unusable was used against Ukrainian Organizations

Another report from SentinelLabs stated that another malware named “HermeticWiper” was also used for attacking organizations in Ukraine. This malware is specifically designed for Windows systems. It manipulates the master boot records of windows OS subsequently resulting in boot failure.

These kinds of destructive malware can pose a great threat to organizations as they can make critical data and assets unavailable by deleting or encrypting them.

Nevertheless, the attacks on the Ukrainian organizations might accidentally target organizations in other countries. However, Every organization must prepare, plan, detect and respond to an event like that.

The Cybersecurity Advisory (CSA), the CISA, and the Federal bureau have jointly provided complete documentation about recommended guidance and advisory for organizations to prevent WhisperGate and HermeticWiper malware.

Technical Details

The CISA has given a list of campaigns about the malware with an in-depth analysis of the impact. They have also given steps to mitigate them and prevent them from damaging critical infrastructure.

WhisperGate malware contains two stages in which it corrupts the master boot record, provides a fake ransomware note, and encrypts particular files based on their extensions.

Though it displays a ransomware note to pay a ransom, it destroys the data even after paying the ransom. Microsoft also stated that the deleted data is not recoverable making this one of the most sophisticated malware operations.

The HermeticWiper on the other hand targets specifically on windows devices and manipulates the master boot record resulting in a boot failure.

Broadcom stated that HermeticWiper has similar operations to WhisperGate malware. The CISA has also posted Indicators of Compromise and additional information about this malware.

The post urged all organizations to implement the required methods to prevent cyberattacks. Malware that is destructive can be spread by different means that include email campaigns, trojan droppers from websites and so many other methods.

As the malware has the potential to target a large scope of systems, it is necessary for organizations to take necessary preventive measures. The CISA document includes a complete set of necessary measures to mitigate the malware.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers

In a disconcerting turn of events, cyber threat actors have set their sights on...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles