Important government and infrastructure sites in Ukraine were hit with devastating data wiper cyberattacks hours before Russia’s invasion. This kind of attack is like ransomware in that it renders important files or entire computers unusable. It just doesn’t offer to undo the damage for money. Logically it would seem that Russia is behind these attacks, but so far there isn’t any hard evidence of that. Researchers at security giant ESET dug into the code of the wiper malware and learned a lot about how it works and when it was deployed, even though they still can’t prove the source of the attack.
Trouble Next Door
While all security companies are keeping an eye on the cyberattacks against Ukraine, ESET has a special reason to be interested. ESET has its headquarters in Bratislava, capital of the Slovak Republic, which borders on the west side of Ukraine, not far from Lviv. I asked a contact at the company how, if at all, the war in Ukraine is affecting them. “Bratislava, where ESET’s HQ is located is a fair distance from the border with Ukraine,” he explained. “So far, the only impact of the conflict on Slovakia are refugees arriving at the border who are receiving immediate help from local authorities.””We are collaborating with Ukrainian organizations affected by the recent cyber-attacks and assisting them in any way we can,” he continued. “Furthermore, ESET have provided financial and humanitarian support.”
Special Malware Delivery
Experts have dubbed the damaging malware HermeticWiper because it was digitally signed by a small game company called Hermetica Digital Ltd, based in the Mediterranean island country of Cyprus. Early reports assumed that the digital certificate was stolen from that company, but that apparently isn’t true. The company reports it never applied for any such certificate, which means the perpetrators must have fraudulently applied in its name. In any case, ESET asked DigiCert to revoke the certificate, and it did so on February 24.
Perhaps more interestingly, the researchers discovered another piece of malicious code signed using the same certificate, a worm that they dubbed HermeticWizard. This worm program, once it inveigles its way into a network, spreads HermeticWiper throughout the network. Unlike a virus, a worm doesn’t need any user interaction to spread.
To do its job, HermeticWizard must scan the network for available computers and copy its code to them. That’s suspicious behavior, likely to be caught by security software. However, the researchers found that this malware scans for available computers using a random selection of ports, to evade detection. After passing along the infection, it invokes HermeticWiper, thereby destroying the evidence.
The malware’s attempts to evade detection may not have even been necessary. A recent study by Austrian testing lab AV-Comparatives challenged almost 20 popular consumer antivirus programs and a similar number of enterprise endpoint protection solutions to defend against HermeticWiper. All tested products mounted a successful defense, which suggests that many victim computers had no antivirus protection at all.
Cyberattack Wannabes
Scanning their vast collection of captured malware, the researchers came across another file signed with the Hermetica digital certificate. This one proved to be an actual ransomware attack, so they dubbed it HermeticRansom.
Within the code, they encountered filenames containing the text string “wHiteHousE” as well as the folder name 403forBiden. The HTTP error numbered 403 is titled Forbidden, which means “the server understands the request but refuses to authorize it.”
On completing its task of encrypting important documents, the malware displays a ransom note that begins “The only thing we learn from new elections is we learned nothing from the old. Thank you for your vote!” and ends, “Have a nice day!” ESET’s team found HermeticRansom to be much less prevalent than HermeticWiper. They suspect that it may have simply been designed to obscure the wiper’s actions.
Then there’s IsaacWiper, the poor cousin. ESET’s researchers detected it in Ukraine right after the Hermetica certificate was revoked. IsaacWiper has no digital signature at all. According to ESET, it “has no code similarity with HermeticWiper and is way less sophisticated.” Did the attackers throw in IssacWiper as cannon fodder once they lost the digital signature validation for the other attacks?
Who’s Responsible?
When an enemy country fires a cannon across the border or launches an ICBM, there’s no doubt who’s behind the attack. Attributing cyberattacks to a specific source is a lot harder. Researchers look for clues such as text strings embedded in the code, connections to known command and control servers, or strong code similarities to other malware that’s been tied to a source. In this case, though, there are no such clues.
As the post by ESET states, “At this point, we have not found any tangible connection with a known threat actor. HermeticWiper, HermeticWizard, and HermeticRansom do not share any significant code similarity with other samples in the ESET malware collection. IsaacWiper is still unattributed as well.”
Without any firm attribution, ESET’s team can’t conclude definitively that the attacks came from Russia. Asked to confirm, a company representative was willing to say, “Our conclusion is that the cyber-attacks, that utilize HermeticWiper and IsaacWiper, appear to have been planned and targeted to cause disruption at the affected organizations in Ukraine.” On the other hand, as far as identifying any threat actor other than Russian, the representative stated, “The ESET research team has not yet been able to attribute these attacks to a known threat actor.”
Yes, there are references to President Biden and the White House in the code, but those could just as well point to an attacker denying the legitimacy of our last election. There’s no smoking gun tying the malware to Russia, but the circumstantial evidence is undeniably strong.
