A brand new knowledge wiper malware named ‘PathWiper’ is being utilized in focused assaults in opposition to essential infrastructure in Ukraine, geared toward disrupting operations within the nation.
The payload was deployed by a official endpoint administration software, indicating that attackers had achieved administrative entry to the system by a previous compromise.
Cisco Talos researchers who found the assault attributed it with excessive confidence to a Russia-linked superior persistent risk (APT).
The researchers examine PathWiper to HermeticWiper, beforehand deployed in Ukraine by the ‘Sandworm’ risk group, which had comparable performance.
Therefore, PathWiper could also be an evolution of HermeticWiper, utilized in assaults by the identical or overlapping risk clusters.
PathWiper’s harmful capabilities
PathWiper executes on course techniques by way of a Home windows batch file that launches a malicious VBScript (uacinstall.vbs), that in flip drops and executes the first payload (sha256sum.exe) [VirusTotal].
The execution mimics the conduct and names related to a official admin software to evade detection.
As a substitute of merely enumerating bodily drives like HermeticWiper, PathWiper programmatically identifies all related drives (native, community, dismounted) on the system.
Subsequent, it abuses Home windows APIs to dismount volumes to organize them for corruption after which creates threads for every quantity to overwrite essential NTFS buildings.
Among the many focused system recordsdata within the root listing of the NTFS are:
- MBR (Grasp Boot Document): The primary sector of a bodily disk holding the bootloader and partition desk.
- $MFT (Grasp File Desk): Core NTFS system file that catalogs all recordsdata and directories, together with their metadata and areas on the disk.
- $LogFile: Journal is used for NTFS transaction logging, monitoring file adjustments, and serving to with integrity checking and restoration.
- $Boot: File containing boot sector and filesystem format data.
PathWiper overwrites the above and one other 5 essential NTFS recordsdata with random bytes, rendering impacted techniques fully inoperable.
The noticed assaults don’t contain extortion or any type of monetary calls for, so their sole intention is destruction and operational disruption.
Cisco Talos revealed file hashes and snort guidelines to assist detect the risk and cease it earlier than it corrupts the drives.
Knowledge wipers have develop into a robust software in assaults on Ukraine for the reason that conflict started, with Russian risk actors generally utilizing them to disrupt essential operations within the nation.
This consists of wipers named DoubleZero, CaddyWiper, HermeticWiper, IsaacWiper, WhisperKill, WhisperGate, and AcidRain.
Patching used to imply complicated scripts, lengthy hours, and infinite hearth drills. Not anymore.
On this new information, Tines breaks down how fashionable IT orgs are leveling up with automation. Patch sooner, scale back overhead, and give attention to strategic work — no complicated scripts required.
