The Hermetic Wiper malware that targeted Ukraine

Several Ukrainian computers and websites faced cyberattacks by a destructive data-wiper malware hours before Russia began its military assault in the country

About Hematic Wiper Malware:

• Hematic Wiper or data wiper malware can erase all the data from the system that it has infected.
• The thing that makes this malware dangerous is that the data once deleted, the data cannot be recovered.
• This malware is quite different from most of the malware out there as it doesn’t steal information, it just destroys it.
• The malware can even attack the system recovery tools without leaving any traces of the attack.
• Several cybersecurity experts believe the infections from the malware have spread widely.

Some specific characteristics of Hematic Wiper malware:

• Attacks are highly targeted:
• So far, the HermeticWiper attacks have been highly targeted. 
• Specifically, the distribution of the wiper does not seem to be leveraging supply chain vulnerabilities or other “super-spreader” techniques to scale the attacks.
• This means that infection will not quickly spill to other geographies.
• Deployment requires privileged admin rights:
• The wiper leverages high privileges on the compromised host to make the host “unbootable” by overriding the boot records and configurations, erasing device configurations and deleting shadow copies (backups).
• Similar tactics were observed in the 2017 NotPetya ransomware attacks, which also targeted Ukrainian infrastructure initially.
• Active Directory can be used as a launchpad:
• In one reported case, the wiper software deployed using Active Directory group policy, which means the threat actors had privileged access to Active Directory.
• This scenario is more commonly used in targeted, human-operated incidents, such as the 2021 Kaseya ransomware supply chain attack.
• Identity compromise is critical:
• It appears that the wiper is configured to NOT encrypt domain controllers. This allows the domain to keep running, enabling the wiper software to utilize valid credentials to authenticate to servers and encrypt those.
• This highlights the critical role of identity in these attacks.
• By stealing or abusing the identities and credentials of employees or authorized third parties, threat actors can access the target network and/or move laterally.