On January 13th, the Microsoft Threat Intelligence Centre (MSTIC) identified multiple cases of malware targeting organisations within the Ukraine. The Ukraine government has indicated that they have \u2018evidence\u2019 that the cyberattack was carried out by Russian nation-state actors. Russia has since stated that it has nothing to do with the attack. Regardless of who initiated the attack, it is seeming that it could prove more destructive and affect more businesses than initially expected. In this article we will discuss how the cyberattack affects systems, the indicators of compromise, how it could have been avoided, and how we can help you from avoiding a similar attack on your business.<\/p>\n\n\n\n
What makes this attack particularly interesting, is that the\nmalware was disguised as ransomware. In this first stage of the attack, once\nthe malware enters a system, it overwrites the Master Boot Record with a ransom\nnote requesting the user to pay $10,000 of Bitcoin to a specified\ncryptocurrency wallet, then send a message to a Tox ID in order to recover the\ndata from the corrupted hard drive.<\/p>\n\n\n\n
However, this ransom note is a ruse, and addition malware is\nexecuted when the device is powered off. The true malware destroys the Master\nBoot Record and its contents. This is not common behaviour for criminal\nransomware as:<\/p>\n\n\n\n
In the second stage of the attack, Stage2.exe <\/em>downloads\nthe additional malware hosted on a Discord channel. Once the malware is\nexecuted, it will locate all files with a certain file extension and corrupt\nthem. Some of the files that would be corrupted include ZIP files, config\nfiles, Excel Documents, Word Documents, images and website documents. This\nprocess is typically irreversible, unless the business has a comprehensive\nbackup solution.<\/p>\n\n\n\n It is assumed that this attack was carried out by a Russian nation-state actor as part of the countries ongoing intimidation campaign against the Ukraine. Initially the organisations affected by this malware attack were government and public sector digital infrastructure, including websites. The malware also spread to other nonprofit and information technology companies. As the attack was not a true ransomware attack, it is believed that it was designed to cause unrest within the country. This attack also coincided with Russia mobilising 100,000 troops on the border of Ukraine.<\/p>\n\n\n\n Thankfully, Microsoft has created and implemented detections\nfor this malware family via Microsoft Defender Antivirus and Microsoft Defender\nfor Endpoint for both on-premises and cloud environments. If your business has\neither of these solutions, it will be protected from this attack. <\/p>\n\n\n\n Attacks from nation-state actors are often highly\nsophisticated and difficult to detect. However, in general, business should\nfollow the below steps to avoid falling victim to an attack:<\/p>\n\n\n\n This attack is another example of how the cybersecurity threat landscape is constantly evolving with hackers disguising attacks and launching destructive multi-stage attacks on a wide variety of businesses. This also further proves, no business is safe from being the target of such an attack, regardless of industry, geolocation or size.<\/p>\n\n\n\n For businesses without in-house cybersecurity expertise, it can be difficult to stay up to date with modern attacks and prevention methods. For this reason, it is often beneficial to outsource your cybersecurity requirements to a trusted third-party. Contact us to find out more about how we protect your business from attacks similar to those on organisation in Ukraine.<\/p>\n","protected":false},"excerpt":{"rendered":" On January 13th, the Microsoft Threat Intelligence Centre (MSTIC) identified multiple cases of malware targeting organisations within the Ukraine. The Ukraine government has indicated that they have \u2018evidence\u2019 that the … <\/p>\nWhat this means to your business<\/h3>\n\n\n\n
How we can help you<\/h3>\n\n\n\n