30 January 2023

Russian Sandworm hackers hit Ukraine with new destructive wiper


Russian Sandworm hackers hit Ukraine with new destructive wiper

ESET threat research group has discovered a new data wiping malware they dubbed “SwiftSlicer,” designed to overwrite crucial files used by the Windows operating system.

The new malware was spotted on January 25, 2023 in a recent cyberattack targeting an organization in Ukraine. The researchers attributed this malware to the Russia-linked Sandworm threat actor known to have been focused on targets in Ukraine.

ESET notes that SwiftSlicer, which is written in Go programming language, was deployed through Group Policy, suggesting the threat actor hijacked the victim’s Active Directory environment.

“Once executed it deletes shadow copies, recursively overwrites files located in %CSIDL_SYSTEM%\drivers, %CSIDL_SYSTEM_DRIVE%\Windows\NTDS and other non-system drives and then reboots computer. For overwriting it uses 4096 bytes length block filled with randomly generated byte,” the cybersecurity firm explained.

ESET has identified several Sandworm-linked malware wipers (HermeticWiper, CaddyWiper, IsaacWiper) since the beginning of the Russia’s invasion of Ukraine in last February. According to the Ukrainian Computer Emergency Response Team (CERT-UA), CaddyWiper (Windows) along with ZeroWipe (Windows), SDelete (Windows), AwfulShred (Linux), and BidSwipe (FreeBSD) malware was deployed in a recent cyberattack against Ukrainian state news agency Ukrinform.

In November 2022, multiple organizations in Ukraine were hit with a series of attacks deploying a new ransomware strain called “RansomBoggs,” linked to Sandworm.

Back to the list

Latest Posts

ShadowSyndicate ransomware group targeting Aiohttp flaw

ShadowSyndicate ransomware group targeting Aiohttp flaw

Organizations are urged to update to Aiohttp v3.9.
18 March 2024
The International Monetary Fund discloses cyberattack affecting 11 email accounts

The International Monetary Fund discloses cyberattack affecting 11 email accounts

The organization did not share any additional details regarding the nature of the attack.
18 March 2024
E-Root Marketplace operator sentenced to 3.5 years in prison

E-Root Marketplace operator sentenced to 3.5 years in prison

It is estimated that over 350,000 compromised credentials were listed for sale on the E-Root Marketplace.
18 March 2024