New Report Reveals NikoWiper Malware That Targeted Ukraine Energy Sector

The Russia-affiliated Sandworm employed but a different wiper malware pressure dubbed NikoWiper as section of an attack that took put in Oct 2022 focusing on an energy sector corporation in Ukraine.

“The NikoWiper is centered on SDelete, a command line utility from Microsoft that is utilised for securely deleting information,” cybersecurity company ESET discovered in its latest APT Exercise Report shared with The Hacker Information.

The Slovak cybersecurity business mentioned the attacks coincided with missile strikes orchestrated by the Russian armed forces aimed at the Ukrainian vitality infrastructure, suggesting overlaps in objectives.

The disclosure will come simply days following ESET attributed Sandworm to a Golang-dependent info wiper dubbed SwiftSlicer that was deployed from an unnamed Ukrainian entity on January 25, 2023.

The superior persistent menace (APT) group joined to Russia’s foreign military services intelligence company GRU has also been implicated in a partly successful attack targeting nationwide news company Ukrinform, deploying as several as five distinct wipers on compromised devices.

The Laptop Unexpected emergency Response Group of Ukraine (CERT-UA) recognized the five wiper variants as CaddyWiper, ZeroWipe, SDelete, AwfulShred, and BidSwipe. The initially 3 of these focused Windows methods, although AwfulShred and BidSwipe took goal at Linux and FreeBSD methods.

The use of SDelete is notable, as it indicates that Sandworm has been experimenting with the utility as a wiper in at the very least two unique scenarios to cause irrevocable problems to the qualified organizations in Ukraine.

That reported, ESET malware researcher Robert Lipovsky explained to The Hacker News that “NikoWiper is a unique malware.”

Moreover weaponizing SDelete, Sandworm’s latest strategies have also leveraged bespoke ransomware households, like Status and RansomBoggs, to lock victim details powering encryption limitations without the need of any option to recover them.

The initiatives are the newest sign that the use of harmful wiper malware is on the increase and is being progressively adopted as a cyber weapon of option among the Russian hacking crews.

“Wipers have not been employed broadly as they’re specific weapons,” BlackBerry’s Dmitry Bestuzhev explained to The Hacker News in a assertion. “Sandworm has been actively performing on establishing wipers and ransomware people used explicitly for Ukraine.”

It really is not just Sandworm, as other Russian state-sponsored outfits these kinds of as APT29, Callisto, and Gamaredon have engaged in parallel initiatives to cripple Ukrainian infrastructure via spear-phishing strategies developed to aid backdoor obtain and credential theft.

According to Recorded Long run, which tracks APT29 (aka Nobelium) less than the moniker BlueBravo, the APT has been connected to new compromised infrastructure that’s likely employed as a lure to provide a malware loader codenamed GraphicalNeutrino.

The loader, whose principal operate is to provide observe-on malware, abuses Notion’s API for command-and-control (C2) communications as very well as the platform’s databases element to shop target info and stage payloads for download.

“Any nation with a nexus to the Ukraine disaster, specially individuals with important geopolitical, financial, or military relationships with Russia or Ukraine, are at improved risk of targeting,” the enterprise said in a technical report posted past week.

The change to Notion, a genuine observe-getting application, underscores APT29’s “broadening but continued use” of well known software package providers like Dropbox, Google Push, and Trello to mix malware traffic and circumvent detection.

Though no second-stage malware was detected, ESET – which also identified a sample of the malware in Oct 2022 – theorized it was “aimed at fetching and executing Cobalt Strike.”

The findings also appear shut on the heels of Russia stating that it was the focus on of “coordinated aggression” in 2022 and that it faced “unprecedented exterior cyber attacks” from “intelligence companies, transnational IT corporations, and hacktivists.”

As the Russo-Ukrainian war formally enters its twelfth month, it remains to be viewed how the conflict evolves forward in the cyber realm.

“Over the previous yr we have witnessed waves of enhanced activity – these as in the spring just after the invasion, in the fall and quieter months in excess of the summer time – but all round there is certainly been a virtually regular stream of attacks,” Lipovsky mentioned. “So a person factor that we can be positive about is that we will be viewing much more cyber attacks.”

Found this article intriguing? Observe us on Twitter  and LinkedIn to go through additional distinctive content we publish.

Some components of this write-up are sourced from:
thehackernews.com