Update: Destructive Malware Targeting Organizations in Ukraine

Text acquired from the source

Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs. Cybersecurity Advisory Update: Destructive Malware Targeting Organizations in Ukraine Last Revised April 28, 2022 Alert Code AA22-057A Summary Actions to Take Today: • Set antivirus and antimalware programs to conduct regular scans. • Enable strong spam filters to prevent phishing emails from reaching end users. • Filter network traffic. • Update software. • Require multifactor authentication. (Updated April 28, 2022) This advisory has been updated to include additional Indicators of Compromise (IOCs) for WhisperGate and technical details for HermeticWiper, IsaacWiper, HermeticWizard, and CaddyWiper destructive malware, all of which have been deployed against Ukraine since January 2022. Additional IOCs associated with WhisperGate are in the Appendix, and specific malware analysis reports (MAR) are hyperlinked below. Refer to MAR-10375867.r1.v1 for technical details on HermeticWiper. Refer to MAR-10376640.r1.v1 for technical details on IsaacWiper and HermeticWizard. Refer to MAR-10376640.r2.v1 for technical details on CaddyWiper. (end of update) Leading up to Russia’s unprovoked attack against Ukraine , threat actors deployed destructive malware against organizations in Ukraine to destroy computer systems and render them inoperable. On January 15, 2022, the Microsoft Threat Intelligence Center (MSTIC) disclosed that malware, known as WhisperGate, was being used to target organizations in Ukraine. According to Microsoft , WhisperGate is intended to be destructive and is designed to render targeted devices inoperable. On February 23, 2022, several cybersecurity researchers disclosed that malware known as HermeticWiper was being