This was immediately followed by credential theft. In the case of an attack against one organization in Ukraine, the attackers appear to have gained access to the network on December 23, 2021, via malicious SMB activity against a Microsoft Exchange Server. However, we are continuing to review and verify findings. Temporal evidence points to potentially related malicious activity beginning as early as November 2021. Initial indications suggest that the attacks may have been in preparation for some time. The wiper does not appear to have any additional functionality beyond its destructive capabilities.

Once run, the wiper will damage the Master Boot Record (MBR) of the infected computer, rendering it inoperable.

Driver file names are generated using the Process ID of the wiper The malware will drop the corresponding file according to the operating system (OS) version of the infected system. The driver files are signed by a certificate issued to EaseUS Partition Master.

It contains 32-bit and 64-bit driver files which are compressed by the Lempel-Ziv algorithm stored in their resource section. Trojan.Killdisk comes in the form of an executable file, which is signed by a certificate issued to Hermetica Digital Ltd.

Sectors targeted included organizations in the financial, defense, aviation, and IT services sectors. Symantec, a division of Broadcom Software, has also found evidence of wiper attacks against machines in Lithuania. UPDATE February 25, 2022, 17:00: This blog has been updated with details on how a known Microsoft SQL Server vulnerability ( CVE-2021-1636) was exploited in at least one attack.Ī new form of disk-wiping malware (Trojan.Killdisk) was used to attack organizations in Ukraine shortly before the launch of a Russian invasion this morning (February 24). UPDATE February 24, 2022, 13:42: This blog has been updated with details about ransomware being used as a possible decoy during some wiper attacks.

Symantec endpoint