Thursday, March 28, 2024

CISA and FBI Warn of Destructive Malware to Destroy Ukraine computer Systems

As tension arises between Russia and Ukraine, the CISA (Cybersecurity and Infrastructure Security Agency) has posted that computer systems in Ukraine are being targeted by threat actors as they seek to make systems in the organizations become inoperable.

The Microsoft Threat Intelligence Center (MSTIC) published a disclosure that a malware known by the name “WhisperGate” which is designed and intended to make the system unusable was used against Ukrainian Organizations

Another report from SentinelLabs stated that another malware named “HermeticWiper” was also used for attacking organizations in Ukraine. This malware is specifically designed for Windows systems. It manipulates the master boot records of windows OS subsequently resulting in boot failure.

These kinds of destructive malware can pose a great threat to organizations as they can make critical data and assets unavailable by deleting or encrypting them.

Nevertheless, the attacks on the Ukrainian organizations might accidentally target organizations in other countries. However, Every organization must prepare, plan, detect and respond to an event like that.

The Cybersecurity Advisory (CSA), the CISA, and the Federal bureau have jointly provided complete documentation about recommended guidance and advisory for organizations to prevent WhisperGate and HermeticWiper malware.

Technical Details

The CISA has given a list of campaigns about the malware with an in-depth analysis of the impact. They have also given steps to mitigate them and prevent them from damaging critical infrastructure.

WhisperGate malware contains two stages in which it corrupts the master boot record, provides a fake ransomware note, and encrypts particular files based on their extensions.

Though it displays a ransomware note to pay a ransom, it destroys the data even after paying the ransom. Microsoft also stated that the deleted data is not recoverable making this one of the most sophisticated malware operations.

The HermeticWiper on the other hand targets specifically on windows devices and manipulates the master boot record resulting in a boot failure.

Broadcom stated that HermeticWiper has similar operations to WhisperGate malware. The CISA has also posted Indicators of Compromise and additional information about this malware.

The post urged all organizations to implement the required methods to prevent cyberattacks. Malware that is destructive can be spread by different means that include email campaigns, trojan droppers from websites and so many other methods.

As the malware has the potential to target a large scope of systems, it is necessary for organizations to take necessary preventive measures. The CISA document includes a complete set of necessary measures to mitigate the malware.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles