The Russian government on Thursday warned of cyber attacks aimed at domestic critical infrastructure operators, as the country’s full-blown invasion of Ukraine enters the second day.
In addition to cautioning of the “threat of an increase in the intensity of computer attacks,” Russia’s National Computer Incident Response and Coordination Center said that the “attacks can be aimed at disrupting the functioning of important information resources and services, causing reputational damage, including for political purposes. “
“A failure to operate [critical information infrastructure] objects for a reason not reliable established should first be considered the result of an attack on the computer,” said the agency.
It also notified about possible influence operations to “form a positive image of Russia in the eyes of international community,” echoing a U.S. Cybersecurity and Infrastructure Security Agency alert (CISA), last week, regarding information manipulation attempts by foreign actors to strike crucial entities.
The agency, however, didn’t share more specifics on the nature of the attacks or their provenance.
The advisory comes as multiple government and banking websites in Russia, including that of military (mil.ru), the Kremlin (kremlin.ru), and the State Duma (duma.gov.ru), were rendered unreachable amid a spate of cyber offensives targeting Ukraine that resulted in the deployment of a data wiper called HermeticWiper on hundreds of machines in the East European nation.
“It’s important to note that the wiper leverages high privileges on the compromised host to make the host ‘unbootable’ by overriding the boot records and configurations, erase device configurations, and delete shadow copies,” Lavi Lazarovitz, head of security research at CyberArk Labs, said in a statement shared with The Hacker News.
“The wiper is configured to not encrypt domain controllers – that is to keep the domain running and allow the ransomware to use valid credentials to authenticate to servers and encrypt those. Lazarovitz explained that compromised identities are used by threat actors to gain access to the network and/or move laterally.
It’s not clear how many networks have been affected by the previously unseen data-wiping malware, which targeted organizations in the financial, defense, aviation, and IT industries, according to Symantec. Broadcom’s subsidiary also stated that it had seen evidence of wiper attacks on machines in Lithuania. This suggests a spillover effect.
What’s more, HermeticWiper shares overlaps with another data wiper called WhisperGate that was first reported as being used against Ukrainian organizations in January. The ransomware virus that was distributed to compromised systems is also part of the malware.
The ransomware malware is a 64-bit, 3. 14 MB .EXE file, written in Golang, per Cybereason’s incident response engineer, Chen Erlich, who shared a preliminary analysis of the executable.
“It appears likely that the ransomware was used as a decoy or distraction from the wiper attacks,” Symantec said. This is similar to previous WhisperGate wiper attacks on Ukraine where ransomware was used as a disguise. “
Initial forensic analysis suggests that the attacks may have been in preparation mode for at least three months, what with potentially related malicious activity detected in a Lithuanian organization as early as November 12, 2021. Also, one of the HermeticWiper samples was found to have a compilation timestamp of December 28, 2021.
While the latest disruptive actions are yet to be formally attributed, the U.K. and U.S. governments linked the DDoS attacks on Ukraine in mid-February to Russia’s Main Intelligence Directorate (also known as GRU).
As the attacks continue to unfold both on the physical and digital realms, Reuters reported that the Ukrainian government is seeking the help of the underground hacker community in the country to fend off cyber infiltrations aimed at critical infrastructure and conduct covert espionage missions against the invading Russian forces.
