Ukrainian Malware Attacks: Fake Ransomware Explained
On January 13th, the Microsoft Threat Intelligence Centre (MSTIC) identified multiple cases of malware targeting organisations within Ukraine. The Ukraine government has indicated that they have ‘evidence’ that the cyberattack was carried out by Russian nation-state actors. Russia has since stated that it has nothing to do with the attack.
Regardless of who initiated the attack, it is seeming that it could prove more destructive and affect more businesses than initially expected. In this article, we will discuss how the cyberattack affects systems, the indicators of compromise, how it could have been avoided, and how we can help you from avoiding a similar attack on your business.
The attack explained
This attack is particularly interesting because the malware was disguised as ransomware. In this first stage of the attack, once the malware enters a system, it overwrites the Master Boot Record with a ransom note requesting the user to pay $10,000 of Bitcoin to a specified cryptocurrency wallet, then sends a message to a Tox ID in order to recover the data from the corrupted hard drive.
However, this ransom note is a ruse, and additional malware is executed when the device is powered off. The true malware destroys the Master Boot Record and its contents. This is not common behaviour for criminal ransomware as:
Nearly all ransomware encrypts the contents of files and the system. This malware overwrites the Master Boot Record, making it impossible to recover the data.
Ransomware payloads are typically customised for each victim
It is not common for a ransomware attack to make use of a Tox ID for communication
In the second stage of the attack, Stage2.exe downloads the additional malware hosted on a Discord channel. Once the malware is executed, it will locate all files with a certain file extension and corrupt them. Some of the files that would be corrupted include ZIP files, config files, Excel Documents, Word Documents, images and website documents. This process is typically irreversible unless the business has a comprehensive backup solution.
It is assumed that this attack was carried out by a Russian nation-state actor as part of the countries ongoing intimidation campaign against Ukraine. Initially, the organisations affected by this malware attack were government and public sector digital infrastructure, including websites. The malware also spread to other non-profit and information technology companies.
As the attack was not a true ransomware attack, it is believed that it was designed to cause unrest within the country. This attack also coincided with Russia mobilising 100,000 troops on the border of Ukraine.
Have you been concerned about Ransomware and how it could damage your business?
Get in touch with a cybersecurity expert today!
Get in touch here
What this means to your business
Thankfully, Microsoft has created and implemented detections for this malware family via Microsoft Defender Antivirus and Microsoft Defender for Endpoint for both on-premises and cloud environments. If your business has either of these solutions, it will be protected from this attack. Acronis have also taken steps to protect their users from this attack.
Attacks from nation-state actors are often highly sophisticated and difficult to detect. However, in general, a business should follow the below steps to avoid falling victim to an attack:
Enable multifactor authentication (MFA) to mitigate potentially compromised credentials and ensure that MFA is enforced for all remote connectivity.
Enable Controlled folder Access (CFA) in Microsoft Defender for Endpoint to prevent MBR/VBR modification.
Implement a comprehensive email security solution to reduce the chance of a phishing attack.
Keep all systems, operating systems and applications up to date with security patches.
Implement a disaster recovery plan and make use of a backup solution. Therefore, if your business does fall victim to an attack, there is no significant downtime or loss of data.
This attack is another example of how the cybersecurity threat landscape is constantly evolving with hackers disguising attacks and launching destructive multi-stage attacks on a wide variety of businesses. This also further proves, no business is safe from being the target of such an attack, regardless of industry, geolocation or size.
How we can help you
For businesses without in-house cybersecurity expertise, it can be difficult to stay up to date with modern attacks and prevention methods. For this reason, it is often beneficial to outsource your cybersecurity requirements to a trusted third party.
Contact us to find out more about how we protect your business from attacks similar to those on organisations in Ukraine.
