Russian Hackers Unleash Devastating Wiper Malware on Ukraine

Researchers reported Thursday that the Russian state-controlled hacking group Sandworm launched a series of destructive cyberattacks in Ukraine's ongoing war against neighboring Ukraine. The group targeted a Ukrainian university with two wipers, a form of malware that aims to permanently destroy sensitive data and often the infrastructure storing it, in April. One wiper, tracked under the name Sting, targeted fleets of Windows computers by scheduling a task named DavaniGulyashaSdeshka, a phrase derived from Russian slang that loosely translates to "eat some goulash," researchers from ESET said. The other wiper is tracked as Zerlot. According to ESET researchers, the wipers were designed to be highly destructive, with the goal of deleting all data on the targeted systems. "The wipers are designed to be very aggressive and to cause maximum damage," said Anton Cherepanov, a researcher at ESET. "They are not just deleting files, but also overwriting the master boot record, which makes it impossible to recover the data." Cherepanov added that the wipers were also designed to be highly stealthy, making it difficult for victims to detect the malware. In June and September, Sandworm unleashed multiple wiper variants against a host of Ukrainian critical infrastructure targets, including organizations active in government, energy, and logistics. The targets have long been in the crosshairs of Russian hackers. There was, however, a fourth, less common target - organizations in Ukraine's grain industry. The grain industry has been a key sector in Ukraine's economy, and the targeting of these organizations by Sandworm has raised concerns about the potential impact on food security. The use of wipers by Sandworm is a new tactic in the group's arsenal, and it highlights the evolving nature of cyber warfare. Wipers are a type of malware that is designed to delete data, rather than steal it. They are often used in conjunction with other types of malware, such as ransomware, to cause maximum damage. The use of wipers by Sandworm also raises concerns about the potential for widespread disruption to critical infrastructure. The targeting of Ukraine's grain industry by Sandworm has also raised concerns about the potential impact on food security. Ukraine is a major producer of grains, including wheat, corn, and sunflower seeds. The targeting of the grain industry by Sandworm could potentially disrupt the global food supply chain, leading to price increases and shortages. The current status of the situation is unclear, but researchers are warning of the potential for further attacks. "We are seeing a trend of increased activity by Sandworm, and we are concerned about the potential for further attacks," said Cherepanov. "We urge organizations to take steps to protect themselves against these types of attacks, including implementing robust security measures and conducting regular vulnerability assessments." In addition to the wiper attacks, researchers are also warning of the potential for other types of cyberattacks, including ransomware and phishing attacks. The use of AI-powered tools by Sandworm has also raised concerns about the potential for more sophisticated and targeted attacks in the future. As the situation continues to evolve, researchers and security experts are urging organizations to remain vigilant and take steps to protect themselves against these types of attacks.