{"id":4340,"date":"2022-02-25T14:05:27","date_gmt":"2022-02-25T14:05:27","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=4340"},"modified":"2026-06-08T09:43:38","modified_gmt":"2026-06-08T09:43:38","slug":"russia-ucraina-attacchi-informatici","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/emerging-threats\/russia-ucraina-attacchi-informatici\/","title":{"rendered":"Russia | Ukraine: Cyber Attacks"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">What is unfolding between Russia and Ukraine on the military front is finding direct correspondence in cyberspace. In the weeks preceding active military operations, we observed multiple cyber attacks targeting Ukrainian companies and government institutions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The attack types identified to date fall into three categories:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>DDoS attacks<\/strong> \u2014 aimed at taking Ukrainian institutional websites and portals offline<\/li><li><strong>Ransomware and Wiper attacks<\/strong> \u2014 designed to destroy and sabotage infrastructure (<em>HermeticWiper<\/em> and <em>PartyTicket<\/em>)<\/li><li><strong>Malware \/ Spyware \/ Trojan attacks<\/strong> \u2014 targeting infrastructure access (no public attribution confirmed at this time)<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Over the past several years, offensive groups associated with the Russian government have demonstrated consistent proficiency across the following ATT&amp;CK tactics:<\/p>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table><thead><tr><th class=\"has-text-align-center\" data-align=\"center\"><strong>Tactic<\/strong><\/th><th class=\"has-text-align-center\" data-align=\"center\"><strong>Procedures<\/strong><\/th><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\">Initial Access<\/td><td class=\"has-text-align-center\" data-align=\"center\">Office 365 Brute Force (<code>T1110<\/code>)<br>VPN Exploitation<br>Spearphishing Email (<code>T1566.001<\/code>)<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Credential Access<\/td><td class=\"has-text-align-center\" data-align=\"center\"><code>ntds.dit<\/code> dump from Domain Controller (<code>T1003.003<\/code>)<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Discovery<\/td><td class=\"has-text-align-center\" data-align=\"center\">BloodHound (<code>T1069<\/code>, <code>T1087<\/code>)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-8f761849 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:100%\">\n<div class=\"wp-block-yoast-seo-table-of-contents yoast-table-of-contents\"><h2>Contents<\/h2><ul><li><a href=\"#h-russia-intelligence-and-apt-groups\" data-level=\"2\">Russia \u2014 Intelligence and APT Groups<\/a><\/li><li><a href=\"#h-public-information-on-the-wiper\" data-level=\"2\">Public Information on the Wiper<\/a><\/li><li><a href=\"#h-attack-dynamics\" data-level=\"2\">Attack Dynamics<\/a><\/li><li><a href=\"#h-hermeticwiper-details\" data-level=\"2\">HermeticWiper \u2014 Details<\/a><\/li><li><a href=\"#h-indicators-of-compromise\" data-level=\"2\">Indicators of Compromise<\/a><\/li><li><a href=\"#h-references\" data-level=\"2\">References<\/a><\/li><\/ul><\/div>\n<\/div>\n<\/div>\n\n\n\n<h2 class=\"has-text-align-center wp-block-heading\" id=\"h-russia-intelligence-and-apt-groups\"><br>Russia \u2014 Intelligence and APT Groups<\/h2>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img decoding=\"async\" width=\"674\" height=\"870\" src=\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2022\/02\/Groups-Russia.jpg\" alt=\"\" class=\"wp-image-4360\" srcset=\"https:\/\/fortgale.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/02\/Groups-Russia.jpg 674w, https:\/\/fortgale.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/02\/Groups-Russia-232x300.jpg 232w\" sizes=\"(max-width: 674px) 100vw, 674px\" loading=\"lazy\" \/><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-public-information-on-the-wiper\">Public Information on the Wiper<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The wiper&#8217;s name derives from the code-signing certificate used by the threat actor to build the executable. The certificate was issued to <strong>Hermetica Digital Ltd<\/strong> \u2014 a shell company or defunct entity. The certificate was revoked following the first public malware analysis reports:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img decoding=\"async\" width=\"697\" height=\"394\" src=\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2022\/02\/FirmaRevocata.png\" alt=\"\" class=\"wp-image-4353\" srcset=\"https:\/\/fortgale.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/02\/FirmaRevocata.png 697w, https:\/\/fortgale.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/02\/FirmaRevocata-300x170.png 300w\" sizes=\"(max-width: 697px) 100vw, 697px\" loading=\"lazy\" \/><figcaption><em>Revoked signature detail in a HermeticWiper sample<\/em><\/figcaption><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-attack-dynamics\">Attack Dynamics<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The wiper was deployed<\/strong> into target infrastructures via a <strong>GPO (Group Policy Object) pushed from a Domain Controller<\/strong> \u2014 distributing the malicious payload to both servers and workstations simultaneously (<code>T1484.001<\/code> \u2014 Group Policy Modification).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This deployment method presupposes prior persistent access to the environment, obtained through one of the following vectors:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Trojan implant (<code>T1059<\/code>)<\/li><li>VPN credential abuse (<code>T1078<\/code>)<\/li><li>Perimeter system vulnerability exploitation (<code>T1190<\/code>)<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In several incidents, deployment of the <strong>PartyTicket<\/strong> Ransomware was observed alongside the wiper \u2014 high-confidence assessment based on public sample analysis.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-hermeticwiper-details\">HermeticWiper \u2014 Details<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The earliest samples of this wiper were identified on the afternoon of <strong>2022-02-23<\/strong>. However, the file compilation timestamp traces back to <strong>2021-12-28<\/strong> \u2014 the probable date of tooling production, indicating pre-planned operational preparation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The malware&#8217;s primary function is to overwrite the first <strong>512 bytes<\/strong> of the <strong>Master Boot Record (MBR)<\/strong> on all connected storage devices, preventing system boot after shutdown (<code>T1561.002<\/code> \u2014 Disk Structure Wipe).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The malware temporarily installs a system driver and service, and modifies registry keys \u2014 for example, setting <code>SYSTEM\\CurrentControlSet\\Control\\CrashControl CrashDumpEnabled<\/code> to <strong>0<\/strong> to disable crash dumps prior to driver execution (<code>T1112<\/code> \u2014 Modify Registry).<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img decoding=\"async\" width=\"643\" height=\"85\" src=\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2022\/02\/Immagine1.jpg\" alt=\"\" class=\"wp-image-4343\" srcset=\"https:\/\/fortgale.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/02\/Immagine1.jpg 643w, https:\/\/fortgale.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/02\/Immagine1-300x40.jpg 300w\" sizes=\"(max-width: 643px) 100vw, 643px\" loading=\"lazy\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The driver leveraged (<code>empntdrv.sys<\/code>) is sourced from <strong>EaseUS Partition Manager<\/strong> \u2014 legitimate software abused to enumerate partition information and initiate wiping operations (<code>T1553.002<\/code> \u2014 Code Signing, legitimate driver abuse).<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img decoding=\"async\" width=\"497\" height=\"315\" src=\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2022\/02\/Immagine2.png\" alt=\"\" class=\"wp-image-4344\" srcset=\"https:\/\/fortgale.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/02\/Immagine2.png 497w, https:\/\/fortgale.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/02\/Immagine2-300x190.png 300w\" sizes=\"(max-width: 497px) 100vw, 497px\" loading=\"lazy\" \/><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-indicators-of-compromise\">Indicators of Compromise<\/h2>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table><tbody><tr><td><strong>HermeticWiper<\/strong><\/td><td><strong>Hash<\/strong><\/td><\/tr><tr><td><strong>Win32 EXE<\/strong><\/td><td>MD5: <code>84ba0197920fd3e2b7dfa719fee09d2f<\/code><br>SHA1: <code>912342f1c840a42f6b74132f8a7c4ffe7d40fb77<\/code><br>SHA256: <code>0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da<\/code><\/td><\/tr><tr><td><strong>Win32 EXE<\/strong><\/td><td>MD5: <code>3f4a16b29f2f0532b7ce3e7656799125<\/code><br>SHA1: <code>61b25d11392172e587d8da3045812a66c3385451<\/code><br>SHA256: <code>1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table><tbody><tr><td><strong>ms-compressed drivers<\/strong><\/td><td><strong>MD5<\/strong><\/td><\/tr><tr><td><strong>RCDATA_DRV_X64<\/strong><\/td><td><code>a952e288a1ead66490b3275a807f52e5<\/code><\/td><\/tr><tr><td><strong>RCDATA_DRV_X86<\/strong><\/td><td><code>231b3385ac17e41c5bb1b1fcb59599c4<\/code><\/td><\/tr><tr><td><strong>RCDATA_DRV_XP_X64<\/strong><\/td><td><code>095a1678021b034903c85dd5acb447ad<\/code><\/td><\/tr><tr><td><strong>RCDATA_DRV_XP_X86<\/strong><\/td><td><code>eb845b7a16ed82bd248e395d9852f467<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table><tbody><tr><td><strong>Trojan.Killdisk<\/strong><\/td><td>SHA256: <code>a64c3e0522fad787b95bfb6a30c3aed1b5786e69e88e023c062ec7e5cebf4d3e<\/code><\/td><\/tr><tr><td><strong>Ransomware (PartyTicket)<\/strong><\/td><td>SHA256: <code>4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-references\">References<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/www.cisa.gov\/uscert\/ncas\/alerts\/aa22-047a\">Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks \u2014 CISA<\/a><\/li><li><a href=\"https:\/\/www.sentinelone.com\/labs\/hermetic-wiper-ukraine-under-attack\/\">HermeticWiper \u2014 New Destructive Malware Used in Cyber Attacks on Ukraine \u2014 SentinelOne<\/a><\/li><li><a href=\"https:\/\/www.welivesecurity.com\/2022\/02\/24\/hermeticwiper-new-data-wiping-malware-hits-ukraine\/\">HermeticWiper: New data-wiping malware hits Ukraine \u2014 WeLiveSecurity<\/a><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Pre-positioned wiper tooling with a six-week lead time between compilation and deployment confirms that destructive capability in state-sponsored operations is prepared in advance of the kinetic trigger.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Resoconto riguardante le operazioni offensive informatiche condotte dalla Russia nei confronti di infrastrutture ucraine durante l&#8217;avvio del conflitto.<\/p>\n","protected":false},"author":7,"featured_media":4360,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[32,3099,3098,3100,3101,424,283,302,3097,429],"class_list":["post-4340","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-emerging-threats","tag-apt","tag-cyber-warfare","tag-ddos","tag-february-2022","tag-geopolitics","tag-hermeticwiper","tag-ransomware","tag-russia","tag-ukraine","tag-wiper"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/4340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=4340"}],"version-history":[{"count":22,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/4340\/revisions"}],"predecessor-version":[{"id":9813,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/4340\/revisions\/9813"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media\/4360"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=4340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=4340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=4340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}