Sandworm continues to conduct assaults in opposition to fastidiously chosen targets within the war-torn nation
ESET researchers have uncovered a new wiper assault in Ukraine that they attribute to the Sandworm APT group.
Dubbed SwiftSlicer, the damaging malware was noticed on the community of a focused group on January twenty fifth. It was deployed via Group Coverage, which means that the attackers had taken management of the sufferer’s Energetic Listing surroundings.
A few of the wipers noticed by ESET in Ukraine early into Russia’s invasion – HermeticWiper and CaddyWiper – had been in some cases additionally planted in the identical style. The latter was final noticed on the community of Ukraine’s information company Ukrinform simply days in the past.
#BREAKING On January twenty fifth #ESETResearch found a brand new cyberattack in 🇺🇦 Ukraine. Attackers deployed a brand new wiper we named #SwiftSlicer utilizing Energetic Listing Group Coverage. The #SwiftSlicer wiper is written in Go programing language. We attribute this assault to #Sandworm. 1/3 pic.twitter.com/pMij9lpU5J
— ESET Analysis (@ESETresearch) January 27, 2023
SwiftSlicer is detected by ESET merchandise as WinGo/KillFiles.C. The malware was written in Go, a extremely versatile, cross-platform programming language.
In relation to SwiftSlicer’s methodology of destruction, ESET researchers had this to say: “As soon as executed it deletes shadow copies, recursively overwrites recordsdata positioned in %CSIDL_SYSTEMpercentdrivers, %CSIDL_SYSTEM_DRIVEpercentWindowsNTDS and different non-system drives after which reboots laptop. For overwriting it makes use of 4096 bytes size block crammed with randomly generated byte”.
Two months in the past, ESET detected a wave of RansomBoggs ransomware assaults within the war-torn nation that had been additionally linked to Sandworm. The campaigns had been simply one of many newest additions to the lengthy résumé of damaging assaults that the group has performed in opposition to Ukraine over the previous near-decade. Sandworm’s monitor document additionally features a string of assaults – BlackEnergy, GreyEnergy and the primary iteration of Industroyer – that focused power suppliers. An Industroyer2 assault was thwarted with assist from ESET researchers in April of final yr.
