Russian Hackers Unleash Destructive Wiper Malware on Ukraine

Researchers reported Thursday that the Russian state-controlled hacking group, Sandworm, launched a series of destructive cyberattacks in Ukraine's ongoing war against neighboring Ukraine. The attacks, which began in April, targeted a Ukrainian university with two wipers, a form of malware that aims to permanently destroy sensitive data and often the infrastructure storing it. One wiper, tracked under the name Sting, targeted fleets of Windows computers by scheduling a task named DavaniGulyashaSdeshka, a phrase derived from Russian slang that loosely translates to "eat some goulash," researchers from ESET said. The other wiper is tracked as Zerlot. According to ESET researchers, the attacks were part of a larger campaign by Sandworm to disrupt Ukraine's critical infrastructure. In June and September, the group unleashed multiple wiper variants against a host of Ukrainian targets, including organizations active in government, energy, and logistics. The targets have long been in the crosshairs of Russian hackers. There was, however, a fourth, less common target: organizations in Ukraine's grain industry. "This is a classic example of a wiper attack, where the goal is to destroy data and make it impossible to recover," said Anton Cherepanov, a senior researcher at ESET. "The fact that Sandworm is using wipers in this way is a sign of their sophistication and willingness to use destructive tactics to achieve their goals." The use of wipers in cyberattacks is a relatively new tactic, but it has become increasingly popular among nation-state actors. Wipers are designed to permanently delete data, making it impossible to recover. This can have devastating consequences for organizations and individuals who rely on that data. The attacks on Ukraine's grain industry are particularly concerning, as they could have significant implications for global food security. Ukraine is a major producer of grain, and disruptions to its agricultural sector could lead to shortages and price increases. The attacks are also a reminder of the ongoing conflict between Russia and Ukraine. The war has been marked by a series of cyberattacks and disinformation campaigns, which have had significant consequences for both countries. "It's a cat-and-mouse game between the two countries, with each side trying to outmaneuver the other," said a cybersecurity expert, who wished to remain anonymous. "The use of wipers is just one tactic in this larger game, and it's a sign of the increasing sophistication of nation-state actors." The current status of the attacks is unclear, but researchers say that the use of wipers is likely to continue. "We expect to see more wiper attacks in the future, as nation-state actors continue to develop and refine their tactics," said Cherepanov. In response to the attacks, Ukraine has taken steps to improve its cybersecurity, including implementing new security protocols and increasing its cyberdefenses. However, the country faces significant challenges in defending against the sophisticated tactics of nation-state actors like Sandworm. The international community has also taken notice of the attacks, with many countries expressing concern about the use of wipers in cyberattacks. The United Nations has called for increased cooperation between countries to combat the threat of cyberattacks, and many experts are calling for greater investment in cybersecurity research and development. As the conflict between Russia and Ukraine continues, the use of wipers and other destructive tactics is likely to remain a major concern. The international community must come together to address this threat and protect against the devastating consequences of cyberattacks.