Actions to Take Today:
• Set antivirus and antimalware programs to conduct regular scans.
• Enable strong spam filters to prevent phishing emails from reaching end users.
• Filter network traffic.
• Update software.
• Require multifactor authentication.
(Updated April 28, 2022) This advisory has been updated to include additional Indicators of Compromise (IOCs) for WhisperGate and technical details for HermeticWiper, IsaacWiper, HermeticWizard, and CaddyWiper destructive malware, all of which have been deployed against Ukraine since January 2022. Additional IOCs associated with WhisperGate are in the Appendix, and specific malware analysis reports (MAR) are hyperlinked below.
(end of update)
Leading up to Russia's unprovoked attack against Ukraine, threat actors deployed destructive malware against organizations in Ukraine to destroy computer systems and render them inoperable.
Destructive malware can present a direct threat to an organization's daily operations, impacting the availability of critical assets and data. Further disruptive cyberattacks against organizations in Ukraine are likely to occur and may unintentionally spill over to organizations in other countries. Organizations should increase vigilance and evaluate their capabilities encompassing planning, preparation, detection, and response for such an event.
This joint Cybersecurity Advisory (CSA) between the Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) provides information on WhisperGate and HermeticWiper malware as well as open-source indicators of compromise (IOCs) for organizations to detect and prevent the malware. Additionally, this joint CSA provides recommended guidance and considerations for organizations to address as part of network architecture, security baseline, continuous monitoring, and incident response practices.
Download the Joint Cybersecurity Advisory: Update: Destructive Malware Targeting Organizations in Ukraine (pdf, 559kb).
Click here for STIX.
Threat actors have deployed destructive malware, including both WhisperGate and HermeticWiper, against organizations in Ukraine to destroy computer systems and render them inoperable. Listed below are high-level summaries of campaigns employing the malware. CISA recommends organizations review the resources listed below for more in-depth analysis and see the Mitigation section for best practices on handling destructive malware.
On January 15, 2022, Microsoft announced the identification of a sophisticated malware operation targeting multiple organizations in Ukraine. The malware, known as WhisperGate, has two stages that corrupts a system's master boot record, displays a fake ransomware note, and encrypts files based on certain file extensions. Note: although a ransomware message is displayed during the attack, Microsoft highlighted that the targeted data is destroyed, and is not recoverable even if a ransom is paid. See Microsoft's blog on Destructive malware targeting Ukrainian organizations for more information and see the IOCs in table 1.
Table 1: IOCs associated with WhisperGate
| Name | File Category | File Hash | Source |
|---|---|---|---|
| WhisperGate | stage1.exe | a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92 | Microsoft MSTIC |
| WhisperGate | stage2.exe | dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78 |
(Updated April 28, 2022) See Appendix: Additional IOCs associated with WhisperGate.
On February 23, 2022, cybersecurity researchers disclosed that malware known as HermeticWiper was being used against organizations in Ukraine. According to SentinelLabs, the malware targets Windows devices, manipulating the master boot record and resulting in subsequent boot failure. Note: according to Broadcom Software, "[HermeticWiper] has some similarities to the earlier WhisperGate wiper attacks against Ukraine, where the wiper was disguised as ransomware." See the following resources for more information and see the IOCs in table 2 below.
Table 2: IOCs associated with HermeticWiper
| Name | File Category | File Hash | Source |
|---|---|---|---|
| Win32/KillDisk.NCV | Trojan | 912342F1C840A42F6B74132F8A7C4FFE7D40FB77 61B25D11392172E587D8DA3045812A66C3385451 | ESET research |
| HermeticWiper | Win32 EXE | 912342f1c840a42f6b74132f8a7c4ffe7d40fb77 | |
| HermeticWiper | Win32 EXE | 61b25d11392172e587d8da3045812a66c3385451 | |
| RCDATA_DRV_X64 | ms-compressed | a952e288a1ead66490b3275a807f52e5 | |
| RCDATA_DRV_X86 | ms-compressed | 231b3385ac17e41c5bb1b1fcb59599c4 | |
| RCDATA_DRV_XP_X64 | ms-compressed | 095a1678021b034903c85dd5acb447ad | |
| RCDATA_DRV_XP_X86 | ms-compressed | eb845b7a16ed82bd248e395d9852f467 | |
| Trojan.Killdisk | Trojan.Killdisk | 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591 | Symantec Threat Hunter Team |
| Trojan.Killdisk | Trojan.Killdisk | 0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da | Symantec Threat Hunter Team |
| Trojan.Killdisk | Trojan.Killdisk | a64c3e0522fad787b95bfb6a30c3aed1b5786e69e88e023c062ec7e5cebf4d3e | Symantec Threat Hunter Team |
| Ransomware | Trojan.Killdisk | 4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382 | Symantec Threat Hunter Team |
As previously noted above, destructive malware can present a direct threat to an organization's daily operations, impacting the availability of critical assets and data. Organizations should increase vigilance and evaluate their capabilities, encompassing planning, preparation, detection, and response, for such an event. This section is focused on the threat of malware using enterprise-scale distributed propagation methods and provides recommended guidance and considerations for an organization to address as part of their network architecture, security baseline, continuous monitoring, and incident response practices.
CISA and the FBI urge all organizations to implement the following recommendations to increase their cyber resilience against this threat.
Destructive malware may use popular communication tools to spread, including worms sent through email and instant messages, Trojan horses dropped from websites, and virus-infected files downloaded from peer-to-peer connections. Malware seeks to exploit existing vulnerabilities on systems for quiet and easy access.
The malware has the capability to target a large scope of systems and can execute across multiple systems throughout a network. As a result, it is important for organizations to assess their environment for atypical channels for malware delivery and/or propagation throughout their systems. Systems to assess include:
While not only applicable to malware, threat actors could compromise additional resources to impact the availability of critical data and applications. Common examples include:
Common strategies can be followed to strengthen an organization's resilience against destructive malware. Targeted assessment and enforcement of best practices should be employed for enterprise components susceptible to destructive malware.
A business impact analysis (BIA) is a key component of contingency planning and preparation. The overall output of a BIA will provide an organization with two key components (as related to critical mission/business operations):
Based upon the identification of an organization's mission critical assets (and their associated interdependencies), in the event that an organization is impacted by destructive malware, recovery and reconstitution efforts should be considered.
To plan for this scenario, an organization should address the availability and accessibility for the following resources (and should include the scope of these items within incident response exercises and scenarios):
Victims of a destructive malware attacks should immediately focus on containment to reduce the scope of affected systems. Strategies for containment include:
As related to incident response and incident handling, organizations are encouraged to report incidents to the FBI and CISA (see the Contact section below) and to preserve forensic data for use in internal investigation of the incident or for possible law enforcement purposes. See Technical Approaches to Uncovering and Remediating Malicious Activity for more information.
All organizations should report incidents and anomalous activity to CISA 24/7 Operations Center at central@cisa.dhs.gov or (888) 282-0870 and/or to the FBI via your local FBI field office or the FBI's 24/7 CyWatch at (855) 292-3937 or CyWatch@fbi.gov.
Updated April 28, 2022:
The hashes in Table 3 contain malicious binaries, droppers, and macros linked to WhisperGate cyber actors activity. The binaries are predominantly .Net and are obfuscated. Obfuscation varies; some of the binaries contain multiple layers of obfuscation. Analysis identified multiple uses of string reversal, character replacement, base64 encoding, and packing. Additionally, the malicious binaries contain multiple defenses including VM checks, sandbox detection and evasion, and anti-debugging techniques. Finally, the sleep command was used in varying lengths via PowerShell to obfuscate execution on a victim's network.
All Microsoft .doc files contain a malicious macro that is base64 encoded. Upon enabling the macro, a PowerShell script runs a sleep command and then downloads a file from an external site. The script connects to the external website via HTTP to download an executable. Upon download, the executable is saved to C:\Users\Public\Documents\ filepath on the victim host.
An identified zip file was found to contain the Microsoft Word file macro_t1smud.doc. Once the macro is enabled, a bash script runs a sleep command and the script connects to htxxps://the.earth.li/~sgtatham/putty/latest/w32/putty.exe. This binary is likely the legitimate Putty Secure Shell binary. Upon download the file is saved to C:\Users\Public\Documents\ file path.
Profile of Malicious Hashes
Table 3: Additional IOCs associated with WhisperGate
Hash | Associated Files |
647ebdca2ef6b74b17bb126df19bf0ed88341650 | loader2132.exe |
24f71409bde9d01e3519236e66f3452236302e46 | saint.exe |
1e3497ac435936be06ba665a4acd06b850cf56b4 | loader.exe |
981319f00b654d0142430082f2e636ef69a377d9 | Yudjcfoyg.exe |
e0dbe49c9398a954095ee68186f391c288b9fcc5 | Project_1.exe |
0ba64c284dc0e13bc3f7adfee084ed25844da3d2 | Hjtiyz.jpg |
6b8eab6713abb7c1c51701f12f23cdff2ff3a243 | Ltfckzl.jpg |
3bbb84206f0c81f7fd57148f913db448a8172e92 | Vgdnggv.jpg |
7c77b1c72a2228936e4989de2dfab95bfbbbc737 | Pfiegomql.jpg |
c0cd6f8567df73e9851dbca4f7c4fbfe4813a2e1 | Fezpwij.jpg |
d6830184a413628db9946faaae8b08099c0593a0 | Bqpptgcal.jpg |
d083da96134924273a7cbc8b6c51c1e92de4f9e1 | loader.jpg |
d599f16e60a916f38f201f1a4e6d73cb92822502 | Debythht.jpg |
9b9374a5e376492184a368fcc6723a7012132eae | Dmhdgocsp.jpg |
86bd95db7b514ea0185dba7876fa612fae42b715 | Zysyrokzk.jpg |
e7917df9feabfedae47d8b905136d52cb5cb7f37 | Baeipiyd.jpg |
b2d863fc444b99c479859ad7f012b840f896172e | Tbopbh.jpg |
d85e1614cf4a1e9ec632580b62b0ecb5f8664352 | Lxkdjr.jpg |
08f0b0d66d370151fd8a265b1f9be8be61cc1aa9 | Twojt.bin |
5ac592332a406d5b2dcfc81b131d261da7e791d2 | Rvlxi.bin |
052825569c880212e1e39898d387ef50238aaf35 | Yarfe.bin |
4c2a0f44b176ba83347062df1d56919a25445568 | Ftvqpq.bin |
d51214461fc694a218a01591c72fe89af0353bc1 | Pkbsu.bin |
1125b2c3c91491aa71e0536bb9a8a1b86ff8f641 | Pkcxiu.bin |
37f54f121bcae65b4b3dd680694a11c5a5dfc406 | loader.bin |
4facd9a973505bb00eb1fd9687cbab906742df73 | loader.bin |
376a2339cbbb94d33f82dea2ea78bb011485e0d9 | Qmpnrffn.bin |
b6793fc62b27ee3cce24e9e63e3108a777f71904 | Vpzhote.bin |
1fc463b2f53ba0889c90cc2b7866afae45a511de | Yymmdbfrb.bin |
ff71f9defc2dd27b488d961ce0fbc6ece56b2962 | Zlhmmwutx.bin |
13ca079770f6f9bdddfea5f9d829889dc1fbc4ed | Xhlnfjeqy.bin |
c99c982d1515ade3da81268e79f5e5f7d550aabd | Gpfsqm.png |
d6ffa42548ff12703e38c5db6c9c39c34fe3d82a | Text only | Text with Images |