Ukraine Archives

Ukraine’s Military Hacked by Russian Backed USB Malware

malware, Ophtek, Phishing, Pteredo, Russian Hackers, Shuckworm, Ukraine, USB_malwaremalware, Ophtek, phishing, Pterodo, Russia, Shuckworm, Ukraine, USB_MalwareOphtek, LLC

Aug 2023

The news footage may focus on military strikes, but, behind the war in Ukraine, cyberattacks are being utilised as a major weapon by Russia.

Government-backed cyberattacks are nothing new, and they will continue to be utilized as part of global espionage campaigns for the foreseeable future. However, while these attacks are unlikely to be aimed at small businesses, the methods and techniques employed are likely to trickle down into the arsenal of smaller hackers. Therefore, in the near future, these powerful attacks could regularly be launched against your business.

At Ophtek, we pride ourselves on keeping our clients up to date on contemporary threats. But we also strive to keep you one step ahead of the hackers. And that’s why we’re going to take you through this latest attack.

Understanding the Mechanics of this Military Hack

Warfare has always relied on much more than just weapons, intelligence has always been equally important. And, with the rise of technology in the digital age, compromising IT equipment has proven to be highly rewarding in the pursuit of sensitive information. This latest attack, which has links with Russia’s FSB security service, has been launched by Shuckworm, a Russian threat actor with a long history of attacks.

February 2023 saw Shuckworm intensifying their attacks against Ukraine, a campaign which has been running for several years. Most notably, Shuckworm have been developing new malware in conjunction with command-and-control servers. Central to these attacks has been a strain of malware called Pterodo. Developed by Shuckworm, Pterodo is a backdoor attack which is executed when malicious USB drives are installed onto PCs. The first step that Pterodo takes is to install shortcut links on the infected PC, with these links given names such as evidence.rtf.lnk in order to tempt users into clicking them.

Clicking these links will install Pterodo on the user’s PC and allow Pterodo to spread through any connected drives and download further malware. To cover its tracks, Pterodo uses a number of innovative approaches. Numerous variants of Pterodo have been developed to bypass identification tools and, in order to conceal their identity, the related command-and-control servers regularly rotate their IP addresses. W hile the USB route for launching this attack appears to be Shuckworm’s preferred method, there is also evidence that it’s being spread through phishing emails.

How Do You Beat Military Backed Hackers?

Threat actors which receive government support are very powerful, but it doesn’t mean they are unbeatable. In fact, this latest attack by Shuckworm can easily be deflected by practicing the following:

Be wary of USB drives: USB drive attacks have been commonplace for many years, so it’s important that you don’t let your guard down. Mysterious USB drives which arrive in the mail or are found out in the parking lot should be fully scrutinized and never plugged into your PCs. As well as compromising data security, malicious USB drives also have the potential to destroy your PC.

Understand the hallmarks of phishing: businesses need to be vigilant against phishing campaigns in order to protect their IT infrastructure. Therefore, make sure your employees know how to identify telltale signs of phishing emails: misspellings, generic greetings, urgent demands, suspicious attachments/links, and email addresses with slight variations. If your team can stay alert to these threats, then you stand a much better chance of protecting your data.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Cyber Attacks Increase After Russia Invades Ukraine

cyber attacks, Hackers, Ophtek, Russian Hackers, Security, UkraineCyber Attacks, hackers, Ophtek, Russian Hackers, security, UkraineOphtek, LLC

Apr 2022

The Russian invasion of Ukraine has created headlines around the world; one of the lesser-known stories to emerge has been the increase of cyber attacks.

Numerous aspects of life have changed since Ukraine was invaded by Russian forces at the end of February. Alongside the military attacks and breakdown in social infrastructure that Ukrainians have had to contend with, there have been consequences for those outside the region as well. Supply chains have broken down, the price of fuel has risen and there is widespread skepticism over global peace. And, with the internet being such an integral part of modern society, there has been a notable rise in the number of cyber attacks occurring.

An Escalation in Cyber Attacks

The ensuing chaos of a war being waged on European soil and the military might of Russia has created the perfect environment for cyber attacks to thrive. Not only has Russia been accused of using cyber attacks as part of their campaign against Ukraine, but hackers have turned the situation to their advantage by exploiting concerns over the conflict.

As early as February, Ukraine was experiencing significant attacks on its defense ministry and two major banks. These DDoS attacks were used to temporarily take down websites associated with the targets and cause panic and certainty in financial and government sectors. Within 48 hours of the conflict breaking out, it was reported that an increase of 800% in the number of cyber attacks originating in Russia had been observed. There has also been a notable increase in attacks against Ukraine from groups allying themselves with Russia, the Stormous hacking group, for example, announced that they intended to target Ukrainian organizations with ransomware.

Independent hackers have also taken advantage of the conflict to boost the emotional credentials of their campaigns. With emotions and sympathies running high across the world, hackers have exploited these concerns by using Ukraine as a key email subject to increase engagement. Spam email campaigns have also been modified to use the Ukraine conflict as emotive honeypot used to trick recipients into making donations to false organizations.

How to Prepare for Spillover Attacks

While most of these attacks have targeted organizations in Ukraine, it’s likely that these attacks will soon spillover into allies of Ukraine and, eventually, any PC on the planet. As such, it’s crucial that you remain on your guard and observe the following:

Ukraine-based red flags: the increase in spam email campaigns means that its likely you will encounter malicious links and attachments arriving in your inbox. These will typically encourage you to engage with a call to action such as visiting a site set up for donations. Eliminate this risk by only visiting official websites through the correct channels.

Allies of Ukraine will be targeted: if you deal with Ukrainian organizations then there’s a chance you will be targeted. This could be the result of cyber attacks which spread through email address books or there’s the risk that you will be directly targeted. Accordingly, you should ramp up your cyber security operations and investigate anything suspicious.

Any source of conflict has the potential to cause uncertainty in the digital landscape and, with the Russia/Ukraine conflict expected to be in place for some time, it’s vital that you protect your IT infrastructures. Not only will this maintain IT continuity, but it will provide support for organizations in Ukraine.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Ukraine Hit by Wiper Malware

Backup, email links, Ophtek, Segment Network, Ukraine, Wiper Malwarebackup, email links, Ophtek, segment network, Ukraine, wiper malwareOphtek, LLC

Mar 2022

As with all aspects of modern life, everything is a target for cybercriminals, even war. And this has been demonstrated with wiper malware attacking Ukraine.

Amidst its conflict with Russian, Ukraine has also had to contend with hundreds of its computers falling victim to a strain of data wiper malware. As the name suggests, wiper malware is used to wipe hard drives clean of any data. While this sounds like ransomware, and indeed wiper malware often promises the return of data for a fee, the chances of retrieving this data from the hackers is zero. It’s a powerful and destructive cyber-attack, one which has the potential to cause significant damage not just to security, but also IT infrastructures.

It’s an attack method which could strike anywhere at any time, you don’t have to be in Ukraine. Therefore, it’s crucial that we understand how wiper malware works. And, more importantly, how to protect your data.

The Cyber-Attack on Ukraine

The wiper malware in this opportunistic attack, which comes at a time of intense internal chaos, has been identified as HermeticWiper. It followed on from an earlier attack which had targeted Ukraine’s banks through a number of co-ordinated DDoS attacks. It came several hours before Russia launched its invasion campaign but, as yet, nobody has been identified as being behind the attack. What is known is that it’s a new strain of malware which, according to its date stamp, was created towards the end of 2021. Clearly, this attack had been in the works for some time.

Once downloaded onto a PC, HermeticWiper sets about wiping all the data from its hard drive. It achieves this objective by taking advantage of existing disc and storage management software. With this software compromised, HermeticWiper turns it against the PC to corrupt any data within its grasp and then reboots the PC. But it doesn’t stop there. HermeticWiper is also keen to attack any data recover software on the machine and also interferes with the hard drive’s rebooting system.

How Do You Stop Wiper Malware?

The government of Ukraine has a significant reach and has appealed to its native hackers to assist in protecting the country’s IT infrastructures. Unfortunately, almost all organizations will struggle to raise this level of support. But there’s still plenty you can do:

Backup Carefully: it’s unlikely that you will be able to retrieve the original copies of your data, but if you backup correctly you shouldn’t have any problems. Malware, of course, can spread through networks like wildfire, so it’s important that you keep copies of your backups on isolated networks. And, don’t forget, multiple backups on different storage mediums is key to retaining your data.

Be Email Aware: email is one of the most common methods for distributing malware and it’s surprisingly easy to fall victim to these attacks. All it takes is a momentary lapse in concentration, such as not checking a link correctly, for malware to take hold of your PC. Therefore, always hover your mouse cursor over links to identify their true destination and, to be completely sure, ask an IT professional to verify the link before doing anything.

Act Quickly If Infected: as soon as a wiper-malware is attacked, it’s critical that you begin segmenting your networking to minimize the malware’s spread. While this will not protect all your data, it will allow you to save large chunks of your data. Accordingly, it’s important you ensure your networks are constantly monitored for unusual activity to help you launch a contingency effort such as this.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Category Archives: Ukraine