CISA and FBI Warn of Destructive Malware to Destroy Ukraine computer Systems

As tension arises between Russia and Ukraine, the CISA (Cybersecurity and Infrastructure Security Agency) has posted that computer systems in Ukraine are being targeted by threat actors as they seek to make systems in the organizations become inoperable.

The Microsoft Threat Intelligence Center (MSTIC) published a disclosure that a malware known by the name “WhisperGate” which is designed and intended to make the system unusable was used against Ukrainian Organizations

Another report from SentinelLabs stated that another malware named “HermeticWiper” was also used for attacking organizations in Ukraine. This malware is specifically designed for Windows systems. It manipulates the master boot records of windows OS subsequently resulting in boot failure.

These kinds of destructive malware can pose a great threat to organizations as they can make critical data and assets unavailable by deleting or encrypting them.

Nevertheless, the attacks on the Ukrainian organizations might accidentally target organizations in other countries. However, Every organization must prepare, plan, detect and respond to an event like that.

The Cybersecurity Advisory (CSA), the CISA, and the Federal bureau have jointly provided complete documentation about recommended guidance and advisory for organizations to prevent WhisperGate and HermeticWiper malware.

Technical Details

The CISA has given a list of campaigns about the malware with an in-depth analysis of the impact. They have also given steps to mitigate them and prevent them from damaging critical infrastructure.

WhisperGate malware contains two stages in which it corrupts the master boot record, provides a fake ransomware note, and encrypts particular files based on their extensions.

Though it displays a ransomware note to pay a ransom, it destroys the data even after paying the ransom. Microsoft also stated that the deleted data is not recoverable making this one of the most sophisticated malware operations.

The HermeticWiper on the other hand targets specifically on windows devices and manipulates the master boot record resulting in a boot failure.

Broadcom stated that HermeticWiper has similar operations to WhisperGate malware. The CISA has also posted Indicators of Compromise and additional information about this malware.

The post urged all organizations to implement the required methods to prevent cyberattacks. Malware that is destructive can be spread by different means that include email campaigns, trojan droppers from websites and so many other methods.

As the malware has the potential to target a large scope of systems, it is necessary for organizations to take necessary preventive measures. The CISA document includes a complete set of necessary measures to mitigate the malware.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.