Damaging “HermeticWiper” malware strikes Ukraine

Ukraine is affected by a variety of cyberattacks. One of the vital fascinating ones is a beforehand unknown malware with damaging payload that has popped up on lots of of Ukrainian machines recently.

On Feb. 23, a tweet from ESET Research claims they discovered a new malware that wipes knowledge, utilized in Ukraine. The timeline follows the DDoS assaults aimed toward a number of essential Ukrainian web sites (Determine A). The research was quickly confirmed by Symantec, a division of Broadcom Software program.

Determine A

A posh timeline of cyber occasions concentrating on Ukraine

Previous to the DDoS operations and the invention of this new wiper, one other assault struck Ukraine in the midst of January, dubbed WhisperGate, uncovered by Microsoft on Jan. 15.

Microsoft reported that WhisperGate had been dropped on sufferer methods (a number of authorities, non-profit and data expertise organizations) in Ukraine on Jan. 13. The malware has been designed to seem like a ransomware, but it surely really had no ransom restoration code within the binary file. It has been developed to be damaging and render its targets unusable.

SEE: Password breach: Why popular culture and passwords don’t combine (free PDF) (TechRepublic)

In parallel to this primary wiper operation, a sequence of web site assaults occurred within the evening between Jan. 13 and 14, as reported by the CERT-UA, the official authorities workforce for responding to pc incidents in Ukraine.

A number of Ukrainian web sites have been defaced to indicate a message written in Ukrainian, Russian and Polish languages (Determine B). WhisperGate was additionally dropped and used on these web sites. In line with the Ukrainian State Service for Particular Communication and Info Safety, on Jan. 13-14, 2022, practically 70 Ukrainian web sites (home and worldwide) have been attacked.

Determine B

The message roughly translated to English, is:

“Ukrainian! All of your private knowledge has been despatched to a public community. All knowledge in your pc is destroyed and can’t be recovered. All details about you stab public, fairy story and anticipate the worst. It’s for you in your previous, the longer term and the longer term. For Volhynia, OUN UPA, Galicia, Poland and historic areas.”

The message proven on the defaced web sites was a picture. Photos, not like textual content, have metadata, generally together with bodily coordinates. On this case, the image had a selected latitude and longitude: a car parking zone of the Warsaw College of Economics in Poland. The selection of utilizing a picture reasonably than textual content was most likely carried out to ship a false flag, equivalent to that GPS place.

Serhiy Demedyuk, the deputy secretary of the nationwide safety and protection council of Ukraine, blamed the attack on a group dubbed UNC1151. He added that UNC1151 is a cyber-espionage group affiliated with the particular companies of the Republic of Belarus.

On Feb. 15, new DDoS assaults began towards the Ukrainian Ministry of Protection along with other targets.

The subsequent occasion on this large sequence of occasions was the looks of the HermeticWiper malware.

HermeticWiper: A really environment friendly, damaging malware

Feb. 23 noticed the looks of stories about HermeticWiper, as ESET began a Twitter thread about it.

Technical analysis rapidly adopted. HermeticWiper is a bit of malware whose function is to render Home windows gadgets unusable by wiping components of it (Determine C).

Determine C

One significantly fascinating attribute of this wiper is that it’s a very well-written malware with only a few customary features, not like many of the different malware unfold round.

The tactic it makes use of for wiping knowledge has been used previously by a couple of menace actors with the notorious wipers Shamoon and Destover: It abuses a authentic Home windows partition supervisor driver to carry out its writing operations. Within the case of HermeticWiper, an EaseUS partition supervisor (empntdrv.sys) was abused.

The malware comprises a number of totally different variations of the driving force and makes use of the suitable one relying on the working system model and structure it runs on. These totally different driver variations are compressed as ms-compressed assets throughout the malware binary. Because the malware is simply 114KB, this driver knowledge takes greater than 70% of it.

One of many first actions carried out by HermeticWiper consists of disabling the amount shadow copy, a system that may assist directors to revive a crashed system.

HermeticWiper then corrupts the Grasp Boot Document (MBR) of the system, and wipes recordsdata in several strategic folders of the Home windows working system:

• C:Paperwork and Settings
• C:System Quantity Info
• C:WindowsSYSVOL
• C:WindowsSystem32winevtLogs

The final damaging motion consists of figuring out if the exhausting drive’s partition file system is FAT or NTFS and corrupts the partition accordingly. As soon as carried out, the system is compelled to close down and can by no means be capable of boot once more.

By doing this, the malware ensures the system is completely unusable.

To this point, HermeticWiper has solely been unfold and utilized in Ukraine. On a sidenote, the identify of this malware comes from the truth that it makes use of a signed certificates from firm identify Hermetica Digital Ltd and was legitimate as of April 2021. In line with SentinelOne’s analysis on HermeticWiper, “it’s doable that the attackers used a shell firm or appropriated a defunct firm to problem this digital certificates.”

The way to keep protected from HermeticWiper?

Utilization of HermeticWiper exterior of Ukraine just isn’t anticipated. Indicators of compromise (IOC) have been shared along with YARA guidelines to assist detect the malware on methods.

In contrast to different malware whose actions are typically managed by a menace actor by way of community communications, HermeticWiper doesn’t want any. Subsequently, there isn’t any community sample to research for detecting the malware, besides whether it is downloaded from a community, through which case it may be helpful to deploy deep packet inspection (DPI) to detect the binary. Endpoints must be scanned for these IOCs.

Disclosure: I work for Pattern Micro, however the views expressed on this article are mine.