1 March 2022

New FoxBlade malware hit Ukrainian networks hours before invasion, says Microsoft


New FoxBlade malware hit Ukrainian networks hours before invasion, says Microsoft

Ukrainian networks were hit with a new round of destructive cyber attacks just hours before Russian military forces crossed the borders of the country, Microsoft said.

The new wave of attacks that targeted Ukraine involved a never-before-seen malware strain, which Microsoft researchers dubbed FoxBlade.

“Several hours before the launch of missiles or movement of tanks on February 24, Microsoft's Threat Intelligence Center (MSTIC) detected a new round of offensive and destructive cyberattacks directed against Ukraine's digital infrastructure,” Microsoft President and Vice-Chair Brad Smith said.

“We immediately advised the Ukrainian government about the situation, including our identification of the use of a new malware package (which we denominated FoxBlade), and provided technical advice on steps to prevent the malware’s success.”

Smith also said that Microsoft added signatures to detect this new exploit to its Defender anti-malware service within three hours of the discovery.

Earlier this month, researchers at cybersecurity firms ESET and Symantec found a new data wiping malware (aka Win32/KillDisk.NCV or HermeticWiper) that infected hundreds of computers on Ukrainian networks just as Russia’s troops invaded Ukraine.

Cybersecurity Help’s statement on the critical situation in Ukraine

On February 24, people in many cities and towns across Ukraine woke up to the sounds of explosions and artillery fire, as the Russian Federation launched a full-scale invasion of the country. Such actions are unacceptable, political ambitions of any man aren’t worth of blood, tears, and destruction of millions of lives. We give our full support to the Ukrainian people in these hard times. No more war!


Back to the list

Latest Posts

Cyber Security Week in Review: April 19, 2024

Cyber Security Week in Review: April 19, 2024

In brief: the LabHost PhaaS platform shut down, Russian military hackers attacked critical infrastructure in the US and Europe, and more.
19 April 2024
Ukrainian military personnel targeted via messaging apps and dating sites

Ukrainian military personnel targeted via messaging apps and dating sites

The threat actor employs a range of software in their malicious activities, including both commercial programs and  open-source tools.
18 April 2024
Russian military hackers targeted US water utilities and hydroelectric facilities in Europe

Russian military hackers targeted US water utilities and hydroelectric facilities in Europe

This marks the first time Russian nation-state hackers have posed a direct threat to critical infrastructure in Western countries.
18 April 2024