30 January 2023

Russian Sandworm hackers hit Ukraine with new destructive wiper


Russian Sandworm hackers hit Ukraine with new destructive wiper

ESET threat research group has discovered a new data wiping malware they dubbed “SwiftSlicer,” designed to overwrite crucial files used by the Windows operating system.

The new malware was spotted on January 25, 2023 in a recent cyberattack targeting an organization in Ukraine. The researchers attributed this malware to the Russia-linked Sandworm threat actor known to have been focused on targets in Ukraine.

ESET notes that SwiftSlicer, which is written in Go programming language, was deployed through Group Policy, suggesting the threat actor hijacked the victim’s Active Directory environment.

“Once executed it deletes shadow copies, recursively overwrites files located in %CSIDL_SYSTEM%\drivers, %CSIDL_SYSTEM_DRIVE%\Windows\NTDS and other non-system drives and then reboots computer. For overwriting it uses 4096 bytes length block filled with randomly generated byte,” the cybersecurity firm explained.

ESET has identified several Sandworm-linked malware wipers (HermeticWiper, CaddyWiper, IsaacWiper) since the beginning of the Russia’s invasion of Ukraine in last February. According to the Ukrainian Computer Emergency Response Team (CERT-UA), CaddyWiper (Windows) along with ZeroWipe (Windows), SDelete (Windows), AwfulShred (Linux), and BidSwipe (FreeBSD) malware was deployed in a recent cyberattack against Ukrainian state news agency Ukrinform.

In November 2022, multiple organizations in Ukraine were hit with a series of attacks deploying a new ransomware strain called “RansomBoggs,” linked to Sandworm.

Back to the list

Latest Posts

Cyber security week in review: March 24, 2023

Cyber security week in review: March 24, 2023

The world in brief: BreachForums data breach site shut down, Bitcoin ATM maker General Bytes suffers a $1.5M hack, and more.
24 March 2023
Lionsgate streaming platform exposed data of 37M users

Lionsgate streaming platform exposed data of 37M users

Researchers discovered an unprotected ElasticSearch instance that contained about 20GB of data.
23 March 2023
New stealthy NUIT attack allows to remotely control Siri, Alexa and other smart voice assistants

New stealthy NUIT attack allows to remotely control Siri, Alexa and other smart voice assistants

The technique involves the use of inaudible sounds embedded in regular audio and video files to send malicious commands.
22 March 2023