Forest Global Training Partners

Cyber Risks · Cisco Talos

Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation

Summary: Cisco Talos reported that attacks on Ukrainian government sites included defacement of almost 80 government websites and WhisperGate wiper malware, with SSSCIP assessing the campaign as a likely false-flag operation meant to appear the work of a pro-Ukrainian group. Talos tied the WhisperKill component to the WhiteBlackCrypt ransomware with over 80 percent similarity, and traced ransom-note email addresses to a July 2020 blog post and a persona named "Zebra" tied to pro-Russian disinformation channels.

Key Takeaway: The defacements appeared in several languages, including Polish that was found to be a Yandex translation of the Russian message, and the actor attempted to blame both Poland and Ukrainians themselves - a deliberate effort to introduce doubt rather than convince anyone. Talos notes that NotPetya, an attack intended to punish Ukraine, had wide-ranging global impact, so any organization with business connections to Ukraine should consider how to isolate and monitor those connections.

Read the original at Cisco Talos ↗

Topics
Malware
Related