Threat Brief: Ongoing Russia and Ukraine Cyber Activity
Summary: Beginning Jan. 14, 2022, a series of attacks left numerous Ukrainian government websites defaced or inaccessible, and Ukraine formally accused Russia of masterminding them. A day later, reporting outlined WhisperGate, destructive malware first observed Jan. 13, 2022 that disables Windows Defender and corrupts files, attributed by Microsoft to a threat actor it calls DEV-0586.
What's compelling: The website defacements are tied to CVE-2021-32648 in OctoberCMS before version 1.0.472, where a crafted password reset request with a boolean true reset code passes validation and lets an attacker take over any account. WhisperGate's Stage1.exe overwrites the master boot record with 512 bytes and Stage2.exe pulls its payload from a JPG hosted on Discord's CDN, so the destructive stage arrives over a legitimate service rather than a suspicious domain.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-32648
- Related
- CVE-2021-32648: October CMS Improper Authentication Known Exploited Vulnerabilities · Jan 18, 2022New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026