HermeticWiper malware victims are now reporting ransomware attacks too

Date:
Tue, 18 Oct 2022 14:18:16 +0000

Description:
Microsoft is trying to determine if the attacks are linked, while the attackers themselves remain unknown.

FULL STORY ======================================================================

Cybersecurity researchers from Microsoft Threat Intelligence Center (MSTIC) have noted companies across Ukraine and Poland being hit by two separate attacks: in one, a disk wiper called HermeticWiper was deployed, while in the other, a ransomware called Prestige.

"Despite using similar deployment techniques, the [Prestige] campaign is distinct from recent destructive attacks leveraging [...] Foxblade (HermeticWiper) that have impacted multiple critical infrastructure organizations in Ukraine over the last two weeks," the researchers explained.

"MSTIC has not yet linked this ransomware campaign to a known threat group
and is continuing investigations." Links to Russia

In some cases, the victim companies are overlapping, but Microsofts researchers are not yet convinced all of this is the work of the same threat actor.

For the time being, Microsoft is tracking the group(s) as DEV-0960, the usual label for threat actors yet to have their identities revealed.

There is tangential evidence of the attackers having connections to the Kremlin, though, as HermeticWiper was first observed in the wild a day before the invasion of Ukraine and - against Ukrainian entities. Read more

Looking for great VPN services? We've got you covered

Russian hackers are raking in ransomware rewards

Hackers have found a new way into your Microsoft 365 account

The researchers dont really know how the attackers managed to compromise the target networks, and whether or not any malware was included. What they do know is that they used two remote-execution tools (RemoteExec and Impacket WMIexec) to control the compromised endpoints .

"The threat landscape in Ukraine continues to evolve, and wipers and destructive attacks have been a consistent theme," Microsoft further said. "Ransomware and wiper attacks rely on many of the same security weaknesses to succeed."

Endpoint security solutions and ransomware protection software may provide with some damage limitations against this new threat. These are the best
cloud backup solutions at the moment

Via: The Register



======================================================================
Link to news story: https://www.techradar.com/news/hermeticwiper-malware-victims-are-reporting-ran somware-attacks-too/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)