A crucial infrastructure entity inside Ukraine was focused by a beforehand unseen information wiper malware named PathWiper, based on new findings from Cisco Talos.
“The assault was instrumented through a reliable endpoint administration framework, indicating that the attackers possible had entry to the executive console, that was then used to challenge malicious instructions and deploy PathWiper throughout related endpoints,” researchers Jacob Finn, Dmytro Korzhevin, and Asheer Malhotra stated in an evaluation printed Thursday.
The assault is assessed to be the work of a Russia-nexus superior persistent menace (APT) actor based mostly on the tradecraft noticed and the overlapping capabilities with harmful malware utilized in assaults in opposition to Ukraine.
Talos stated the instructions issued by the executive instrument’s console have been acquired by its consumer working on the sufferer endpoints after which executed as a batch (BAT) file.
The BAT file, in flip, consisted of a command to run a malicious Visible Fundamental Script (VBScript) file within the Home windows TEMP folder known as “uacinstall.vbs,” that was additionally pushed to the machines through the executive console. The VBScript, for its half, dropped the wiper binary below the identify “sha256sum.exe” in the identical folder and executed it.
“All through the course of the assault, filenames and actions used have been meant to imitate these deployed by the executive utility’s console, indicating that the attackers had prior data of the console and presumably its performance throughout the sufferer enterprise’s atmosphere,” Talos stated.
As soon as launched, PathWiper is designed to assemble an inventory of related storage media, together with bodily drive names, quantity names and paths, and community drive paths. The wiper then proceeds to create one thread per drive and quantity for each path recorded and overwrites the contents of the artifacts with randomly generated bytes.
Particularly, it targets: Grasp Boot Document (MBR), $MFT, $MFTMirr, $LogFile, $Boot, $Bitmap, $TxfLog, $Tops, and $AttrDef. As well as, PathWiper irrevocably destroys information on disk by overwriting them with randomized bytes and makes an attempt to dismount volumes.
PathWiper has been discovered to share some stage of similarity with HermeticWiper (aka FoxBlade, KillDisk, or NEARMISS), which was detected coinciding with Russia’s full-scale army invasion of Ukraine in February 2024. The HermeticWiper malware is attributed to the Russia-linked Sandworm group.
Whereas each wipers try and corrupt the MBR and NTFS-related artifacts, it bears noting that HermeticWiper and PathWiper differ within the method the info corruption mechanism is used in opposition to recognized drives and volumes.
“The continued evolution of wiper malware variants highlights the continuing menace to Ukrainian crucial infrastructure regardless of the longevity of the Russia-Ukraine warfare,” the researchers stated.
Silent Werewolf Targets Russia and Moldova
The invention of a brand new breed of wiper malware in opposition to Ukraine comes as Russian cybersecurity firm BI.ZONE uncovered two new campaigns undertaken by Silent Werewolf in March 2025 to contaminate Moldovan and Russian corporations with malware.
“The attackers employed two separate loader cases to retrieve the malicious payload from their C2 server,” the corporate stated. “Sadly, the payload itself was not out there on the time of this analysis. Nevertheless, a retrospective evaluation of comparable Silent Werewolf campaigns means that the menace actor used XDigo malware.”
A few of the targets of the assaults embrace nuclear, plane, instrumentation, and mechanical engineering sectors in Russia. The start line is a phishing e-mail containing a ZIP file attachment that, in flip, contains an LNK file and a nested ZIP archive. The second ZIP file consists of a reliable binary, a malicious DLL, and a decoy PDF.
Unpacking and launching the Home windows shortcut file triggers the extraction of the nested archive and in the end causes the rogue DLL to be sideloaded through the reliable executable (“DeviceMetadataWizard.exe”). The DLL is a C# loader (“d3d9.dll”) that is designed to retrieve the next-stage payload from a distant server and show the lure doc to the sufferer.
“The adversaries seem to run checks on the right track methods,” BI.ZONE stated. “If a goal host doesn’t meet sure standards, the Llama 2 massive language mannequin (LLM) in GGUF format is downloaded from hxxps://huggingface[.]co/TheBloke/Llama-2-70B-GGUF/resolve/fundamental/llama-2-70b.Q5_K_M.gguf.”
“This hinders the great evaluation of all the assault and permits the menace actor to bypass defenses equivalent to sandboxes.”
The cybersecurity agency stated it noticed a second marketing campaign that very same month concentrating on unknown sectors in Moldova and, possible, Russia utilizing the identical C# loader, however through phishing lures associated to official trip schedules and proposals for safeguarding company data infrastructure in opposition to ransomware assaults.
The cyber espionage group, per BI.ZONE, is believed to be energetic at the least since 2011, concentrating on a variety of corporations in Russia, Belarus, Ukraine, Moldova and Serbia. The assaults are characterised by means of phishing lures to ship malware equivalent to XDSpy, XDigo, and DSDownloader.
Professional-Ukrainian Hacktivist Group BO Crew Targets Russia
In latest months, Russian state-owned corporations and organizations spanning know-how, telecommunications, and manufacturing verticals are additionally stated to have come below cyber assaults from a pro-Ukrainian hacktivist group codenamed BO Crew (aka Black Owl, Hoody Hyena, and Lifting Zmiy).
“BO Crew is a severe menace aimed each at inflicting most harm to the sufferer and at extracting monetary advantages,” Kaspersky researchers stated in a report final week, detailing the menace actor’s potential to sabotage sufferer’s infrastructure and, in some cases, even resorts to information encryption and extortion.
Lively since at the least January 2024, assaults mounted by the hacktivist cluster are recognized to leverage post-exploitation frameworks, together with Mythic and Cobalt Strike, in addition to reliable distant entry and tunneling instruments. The group additionally has a historical past of accessing confidential information and publishing details about profitable assaults in its Telegram channel BO Crew.
Preliminary entry to focus on networks is completed by sending phishing emails containing booby-trapped attachments that, when opened, activate an an infection chain designed to deploy recognized commodity malware households like DarkGate, BrockenDoor, and Remcos RAT. Additionally used are instruments equivalent to HandleKatz and NanoDump for dumping LSASS and creating LSASS dumps, respectively.
Armed with the distant entry, BO Crew has been noticed destroying file backups, deleting information utilizing the SDelete utility, and moreover dropping the Home windows model of the Babuk encryptor to demand a ransom in alternate for regaining entry.
A few of the different actions carried out by the menace actor are listed under –
- Establishing persistence utilizing scheduled duties
- Assigning malicious element names just like system or well-known executable information to evade detection
- Extracting the Lively Listing database utilizing ntdsutil
- Operating varied instructions to gather details about Telegram, working processes, present customers, distant RDP classes, and antivirus software program put in on the endpoints
- Utilizing RDP and SSH protocols to carry out lateral motion inside Home windows and Linux infrastructures
- Dropping reliable distant entry software program like AnyDesk for command-and-control
“The BO Crew group poses a big menace to Russian organizations as a consequence of its unconventional method to conducting assaults,” Kaspersky stated. “Not like most pro-Ukrainian hacktivist teams, BO Crew actively makes use of a large arsenal of malware, together with backdoors equivalent to BrockenDoor, Remcos, and DarkGate.”
“These options verify the excessive stage of autonomy of the group and the absence of secure connections with different representatives of the pro-Ukrainian hacktivist cluster. Within the public exercise of BO Crew, there are virtually no indicators of interplay, coordination or alternate of instruments with different teams. This as soon as once more emphasizes its distinctive profile throughout the present hacktivist panorama in Russia.”