Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Wiper. Show all posts
Wiper
Cyber Attacks DDOS Attacks EU Malicious Files NCSC Russia-Ukraine War Spyware Attack Wiper

Russia Dubbed as the "Centre" of European-wide Cyber-Attacks

 

Since the beginning of Russia's invasion of Ukraine, the EU, UK, US, and other allies have recognized that Russia has been behind a wave of cyber-attacks. The most recent distributed denial-of-service (DDoS) attack on Viasat's commercial communications network in Ukraine, which occurred on the same day that Russia launched its full-fledged invasion, had a greater impact across Europe, disrupting wind farms and internet users. 

The outage on Viasat affected almost one-third of bigblu's 40,000 users throughout Europe, including Germany, France, Hungary, Greece, Italy, and Poland, according to Eutelsat, the parent company of bigblu satellite internet service. The incident impacted wind farms and internet users in central Europe, creating outages for thousands of Ukrainian customers. 

In the regard, the key statements by the West are as follows:

  • The European Union said that Russia was behind the strike, which occurred "one hour before" the invasion of Ukraine. 
  • Estonia: The member of the European Union went even further. With "high certainty," the country blamed the hack on Russia's military intelligence arm, saying it had "gone counter to international law." 
  • The United Kingdom's National Cyber Security Centre is "almost convinced" that Russia was behind the Viasat attack, according to the UK, citing "new UK and US intelligence." Meanwhile, the report said that "Russian Military Intelligence was probably certainly involved" in defacing Russian websites and releasing damaging spyware.
The main aim, according to the joint intelligence advisory, was the Ukrainian military. "Thousands of terminals have been destroyed, rendered useless, and are unable to be restored," according to Viasat. Russian military intelligence was likely certainly engaged in the January 13 attacks on Ukrainian official websites and the distribution of Whispergate harmful malware, according to the UK's National Cyber Security Centre (NCSC). 

"This is clear and alarming proof of an intentional and malicious attack by Russia against Ukraine, which had huge ramifications for ordinary people and businesses in Ukraine and across Europe," Foreign Secretary Liz Truss said. 

In the past Russian criminals hijacked the updater system of Ukrainian accounting software provider MEDoc in June 2017, infecting MEDoc users with the wiper virus NotPetya. The evidence suggests that Wiper malware infected several Ukrainian government networks again in 2022, and Gamaredon attacks targeted roughly 5,000 entities, including key infrastructure and government departments.

NCSC director of operations Paul Chichester addressed why the attribution was being done now, two and a half months after the occurrence, at a press conference at CYBERUK 2022. "We execute attributions in a process-driven manner; accuracy is extremely essential to us," he explained. Collaboration with international bodies such as the EU and the Five Eyes adds to the length of time it took to provide this material. 

Such cyber action aims to demoralize the public and degrade essential infrastructure. The perceived difficulties of precisely attributing the attack to any single aggressor is a benefit of conducting the earliest stages of kinetic activity in cyberspace. Putin has been emphatic in his denial of any Russian government participation in the attacks.
Read more »
Wiper
Chaos Malware malware Ransomware Wiper

Chaos Malware: The Amalgam of Ransomware and Wiper

 

A new strain of malware called Chaos, which is still under active development has been discovered by the security experts. The malware was first spotted in June 2021 and has already gone through four different versions, the most recent of which was released on August 5. 

According to Trend Micro security researcher Monte de Jesus, this rapid growth indicates that the malware may soon be ready for use in real world attacks.

An attacker promoting Chaos malware initially claimed that the malware was a .NET variant of Ryuk ransomware, but the analysis of the malware uncovered that it’s more like a destructive trojan or wiper than traditional ransomware.

“Instead of encrypting files (which could then be decrypted after the target paid the ransom), it replaced the files’ contents with random bytes, after which the files were encoded in Base64. This meant that affected files could no longer be restored, providing victims no incentive to pay the ransom,” de Jesus explained. 

Modus operandi of Chaos Malware 

The first version of Chaos is exceedingly dangerous because of its worming functionality. The malware has the capability to spread to all removable drives on a compromised system. “This could permit the malware to jump onto removable drives and escape from air-gapped systems,” de Jesus said.

After the installation, this first version of Chaos looked for various file paths and extensions to infect, and then it dropped a ransom note which demanded payment of 0.147 BTC, that would be around $6,600.

Chaos 2.0 has the capability to erase volume shadow copies and the backup catalog to prevent recovery, along with disabling Windows recovery mode, but it still did not have the functionality to recover files

“However, version 2.0 still overwrote the files of its targets. Members of the forum where it was posted pointed out that victims wouldn’t pay the ransom if their files couldn’t be restored,” de Jesus added.

In version 3.0, it added encryption to the mix. It could now encrypt files under 1 MB using AES/RSA encryption and feature a decryptor-builder.

The latest version of Chaos was released on August 5, which expanded its encryption feature to files of 2 Mb in size. It also allows operators to append encrypted files with their private extensions. 

According to a recent mid-year report from SonicWall, ransomware has been growing with a rapid pace in 2021, with global attack volume increasing in the first half of the year compared to the same period the previous year. 

“In our view, the Chaos ransomware builder is still far from being a finished product since it lacks features that many modern ransomware families possess, such as the ability to collect data from victims that could be used for further blackmail if the ransom is not paid. In the hands of a malicious actor who has access to malware distribution and deployment infrastructure, it could cause great damage to organizations,” de Jesus concluded.
Read more »
Wiper
Hackers Iran Iranian railway malware Wiper

Wiper Malware Used in Attack Against Iranian Railway

 

The cyber-attack that crippled Iran's national railway system at the beginning of the month was caused by a disk-wiping malware strain called Meteor, not a ransomware attack, as per the research published by security firms Amnpardaz and SentinelOne. 

According to Reuters, the attack caused train services to be affected as well as the transport ministry's website to fall down. But the assault wasn't simply meant to cause havoc. A number for travelers to contact for further information about the difficulties was also put into displays at train stations by the attackers. 

As per Juan Andres Guerrero-Saade, Principal Threat Researcher at SentinelOne, this is the first time this malware has been used and also stated Meteor is yet to be linked to a previously identified group. 

Meteor malware: A part of a well-planned attack

The Meteor wiper was precisely one of three components of a broader malware arsenal placed on the systems of the Iranian railway computers on July 9, according to the firm's research. 

The attacks, which SentinelOne tracked under the codename of MeteorExpress, and led to trains being canceled or delayed across Iran, involved: 
1.Meteor – malware that wiped the infected computer’s filesystem. 
2.A file named mssetup.exe that played the role of an old-school screen locker to lock the user out of their PC. 
3.And a file named nti.exe that rewrote the victim computer’s master boot record (MBR). 

Although Guerrero-Saade did not state how or where the attack began, he did mention that once inside a network, the attackers utilized group policies to deploy their malware, deleted shadow volume copies to stop data recovery, and disconnected infected hosts from their local domain controller, to avoid sysadmins from quickly fixing infected systems. 

Infected computers' filesystems were deleted after the attack, and their displays flashed a message instructing victims to contact a phone number associated with Supreme Leader Ayatollah Ali Khamenei's office, all as a prank from the attackers' perspective. 

The MeteorExpress campaign and wiper assaults appeared to be a witty prank directed at Iranian government officials, the malware employed was not. Meteor and all of the other MeteorExpress elements comprised "a bizarre amalgam of custom code," according to Guerrero-Saade, that combined open-source components with old software and custom-written parts that were "rife with sanity checks, error checking, and redundancy in accomplishing its goals." 

The Meteor code included some of the same features as the screen-locking component or the adjacent deployment batch scripts. The SentinelOne researcher stated, “Even their batch scripts include extensive error checking, a feature seldom encountered with deployment scripts.” 

While certain sections of the malware looked to have been developed by a skilled and professional developer, Guerrero-Saade also notes that the MeteorExpress attack's irregular nature indicates the malware and the overall operation were cobbled together in a hurry by several teams.

SentinelOne stated it's unknown if Meteor was put together especially for this operation or if we'll see the malware strain in a different form in the future because it was assembled just six months before the attack on the Iranian railway system.
Read more »
Wiper
Fake Sites Japan malware Tokyo Olympics Wiper

Cyberattacks Zero in Tokyo Olympics as Games Begin

 

Malicious malware and websites have targeted both event organizers and regular spectators as the Tokyo Olympics' opening ceremony approaches. 

According to Tokyo-based Mitsui Bussan Secure Directions, this malware was published to the VirusTotal malware-scanning site on 20 July and has been identified by numerous antivirus software companies throughout the world. 

A fraudulent PDF file masquerades as a Japanese-language document on cyberattacks associated with the Olympics. When users open it, malware enters their computer and deletes the documents. The dubious PDF was allegedly sent to Japanese event officials by hackers in an effort to erase important Olympics-related data. 

Takashi Yoshikawa of MBSD cautioned concerning the "wiper" malware. The so-called Olympic Destroyer virus caused severe system interruptions at the 2018 Winter Games in Pyeongchang, South Korea. 

TXT, LOG, and CSV files, which can occasionally hold logs, databases, or password information, are targeted for deleting alongside Microsoft Office files. Furthermore, the wiper targets files generated using the Ichitaro Japanese word processor, leading the MBSD team to assume that the wiper was designed particularly for PCs in Japan, where the Ichitaro program is often installed. 

Yoshikawa added, "This is the type of attack we should be most concerned about for the Tokyo Olympics, and we need to continue keeping a close eye on this." 

Fraud streaming sites have also become a major source of concern for the Games, especially now that COVID-19 concerns have virtually prohibited viewers. The websites, which appeared when users searched for Olympic-related phrases on search engines like Google, require users to accept browser alerts so that malicious advertising can be shown. Numerous sites of this sort have previously been discovered by Trend Micro. 

In Japan, Olympic content is provided for free of cost on two official streaming service platforms: one operated by state broadcaster NHK, and the other named TVer, which is managed by commercial broadcasters. In the country, other streamers are not permitted. 

Trend Micro advises that clicking those links might expose the user to assault, advising viewers to watch the Olympics on officially recognized sites. Fake Olympics websites featuring important keywords like "Tokyo" or "2020" in their domain names are another concern. In a probable phishing attack, the login information of ticket purchasers and volunteers was also exposed online. Organizers are advising prudence in the wake of such dangers.
Read more »
Subscribe to: Posts (Atom)