In a nutshell: Safety researchers from ESET have recognized a particular kind of malware referred to as SwiftSlicer deployed in latest assaults in opposition to Ukrainian targets. SwiftSlicer targets essential Home windows working system information and Energetic Listing (AD) databases. Primarily based on the workforce’s findings, the malware can destroy working system sources and cripple complete Home windows domains.
The researchers recognized the SwiftSlicer malware deployed throughout a cyberattack focusing on Ukrainian know-how retailers. The malware ware was written utilizing a cross-platform language referred to as Golang, higher often known as Go, and makes use of an Energetic Listing (AD) Group Coverage assault vector.
#BREAKING On January twenty fifth #ESETResearch found a brand new cyberattack in 🇺🇦 Ukraine. Attackers deployed a brand new wiper we named #SwiftSlicer utilizing Energetic Listing Group Coverage. The #SwiftSlicer wiper is written in Go programing language. We attribute this assault to #Sandworm. 1/3 pic.twitter.com/pMij9lpU5J
— ESET Analysis (@ESETresearch) January 27, 2023
The announcement notes that the malware recognized as WinGo/Killfiles.C. On execution, SwiftSlicer deletes shadow copies and recursively overwrites information, then reboots the pc. It overwrites the info utilizing 4,096 byte-length blocks comprised of randomly generated bytes. Overwritten information are usually positioned within the %CSIDL_SYSTEMpercentdrivers, %CSIDL_SYSTEM_DRIVEpercentWindowsNTDS, and several other different non-system drives.
Analysts attributed the wiper-style malware to the Sandworm hacking group, which serves Russia’s Normal Workers Major Intelligence Directorate (GRU) and Major Middle for Particular Applied sciences (GTsST). The newest assault is paying homage to the latest HermeticWiper and CaddyWiper outbreaks deployed throughout Russia’s invasion.
Researchers famous that hackers contaminated the targets in all three wiper assaults through the identical AD-based vector. The similarities in deployment strategies lead ESET to consider that the Sandworm actors might have taken management of their goal’s Energetic Listing environments previous to initiating the assault.
To say Sandworm has been busy for the reason that Ukraine battle could be an understatement. The Ukrainian Laptop Emergency Response Workforce (CERT-UA) lately found one other mixture of a number of data-wiping malware packages deployed to the Ukrinform information company’s networks. The malware scripts focused Home windows, Linux, and FreeBSD programs and contaminated them with a number of malware payloads, together with CaddyWiper, ZeroWipe, SDelete, AwfulShred, and BidSwipe.
UPDATE: UAC-0082 (suspected #Sandworm) to focus on Ukrinform utilizing 5 variants of damaging software program: CaddyWiper, ZeroWipe, SDelete, AwfulShred, BidSwipe.
Particulars: https://t.co/vFIiRvXm0u (UA solely)
— CERT-UA (@_CERT_UA) January 27, 2023
In accordance with CERT-UA, the assaults have been solely partially profitable. Considered one of Sandworm’s listed malware packages, CaddyWiper, was additionally found in a failed assault that focused one in all Ukraine’s largest vitality suppliers in April of 2022. Researchers at ESET helped throughout that assault by working with CERT-UA to remediate and shield the community.