ESET threat research group has discovered a new data wiping malware they dubbed “SwiftSlicer,” designed to overwrite crucial files used by the Windows operating system.
The new malware was spotted on January 25, 2023 in a recent cyberattack targeting an organization in Ukraine. The researchers attributed this malware to the Russia-linked Sandworm threat actor known to have been focused on targets in Ukraine.
ESET notes that SwiftSlicer, which is written in Go programming language, was deployed through Group Policy, suggesting the threat actor hijacked the victim’s Active Directory environment.
“Once executed it deletes shadow copies, recursively overwrites files located in %CSIDL_SYSTEM%\drivers, %CSIDL_SYSTEM_DRIVE%\Windows\NTDS and other non-system drives and then reboots computer. For overwriting it uses 4096 bytes length block filled with randomly generated byte,” the cybersecurity firm explained.
ESET has identified several Sandworm-linked malware wipers (HermeticWiper, CaddyWiper, IsaacWiper) since the beginning of the Russia’s invasion of Ukraine in last February. According to the Ukrainian Computer Emergency Response Team (CERT-UA), CaddyWiper (Windows) along with ZeroWipe (Windows), SDelete (Windows), AwfulShred (Linux), and BidSwipe (FreeBSD) malware was deployed in a recent cyberattack against Ukrainian state news agency Ukrinform.
In November 2022, multiple organizations in Ukraine were hit with a series of attacks deploying a new ransomware strain called “RansomBoggs,” linked to Sandworm.
