New Wiper Malware HermeticWiper targets Ukrainian systems

Cybersecurity experts discovered a new data wiper malware that was used in attacks against hundreds of machines in Ukraine.

The threat of hybrid warfare is reality, Russia-linked APT group have supported the operations of the Russian army while preparing for the invasion.

Researchers from cybersecurity firms ESET and Broadcom’s Symantec discovered a new data wiper malware that was employed in a recent wave of attacks that hit hundreds of machines in Ukraine.

A tweet from ESET revealed that the company’s telemetry shows the presence of the wiper, tracked as “HermeticWiper” (aka KillDisk.NCV), on hundreds of machines in the country. According to the security firm, the infections followed the DDoS attacks against several Ukrainian websites, including Ministry of Foreign Affairs, Cabinet of Ministers, and Rada.

The first sample of the wiper was observed by ESET yesterday around 14h52 UTC (16h52 local time), but more interesting is the PE compilation timestamp of one of the samples which is 2021-12-28, suggesting that the cyber attack might have been in preparation for almost two months.

The malicious binary was signed using a code signing certificate issued to Hermetica Digital Ltd.

The wiper abuses legitimate drivers from the EaseUS Partition Master software for corrupt data.

In at least one of the targeted organizations, the attackers have taken control of the Active Directory server and dropped via the default Group Policy Object (GPO).

At this time, there is no info to determine the impact of attacks employing the data wiper. Experts did not publicly attribute the attack to Russia, anyway, this is the second wiper that was deployed in a few weeks on Ukrainian computer systems after the WhisperGate.

Yesterday, a new wave of DDoS attacks hit Ukrainian government websites and banks.

“Today, websites of a number of government and banking institutions have undergone a massive DDoS attack again. Some of the attacked information systems are not available or work intermittently. This is due to switching traffic to another provider to minimize damage. Other websites effectively resist the attack and work normally.” reads the alert published by State Service of Special Communications and Information Protection of Ukraine.

“Currently, the State Service of Special Communications and Information Protection of Ukraine and other subjects of the national cybersecurity system are working on countering the attacks, collecting and analyzing information.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Ukraine)