This joint Cybersecurity Advisory (CSA) between the Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) provides information on WhisperGate and HermeticWiper malware as well as open-source indicators of compromise (IOCs) for organizations to detect and prevent the malware. Organizations should increase vigilance and evaluate their capabilities encompassing planning, preparation, detection, and response for such an event.

Further disruptive cyberattacks against organizations in Ukraine are likely to occur and may unintentionally spill over to organizations in other countries.

According to SentinelLabs, the malware targets Windows devices, manipulating the master boot record, which results in subsequent boot failure.ĭestructive malware can present a direct threat to an organization’s daily operations, impacting the availability of critical assets and data. On February 23, 2022, several cybersecurity researchers disclosed that malware known as HermeticWiper was being used against organizations in Ukraine.According to Microsoft, WhisperGate is intended to be destructive and is designed to render targeted devices inoperable. On January 15, 2022, the Microsoft Threat Intelligence Center (MSTIC) disclosed that malware, known as WhisperGate, was being used to target organizations in Ukraine.Leading up to Russia’s unprovoked attack against Ukraine, threat actors deployed destructive malware against organizations in Ukraine to destroy computer systems and render them inoperable. Refer to MAR-10376640.r2.v1 for technical details on CaddyWiper.Refer to MAR-10376640.r1.v1 for technical details on IsaacWiper and HermeticWizard.Refer to MAR-10375867.r1.v1 for technical details on HermeticWiper.Additional IOCs associated with WhisperGate are in the Appendix, and specific malware analysis reports (MAR) are hyperlinked below. (Updated April 28, 2022) This advisory has been updated to include additional Indicators of Compromise (IOCs) for WhisperGate and technical details for HermeticWiper, IsaacWiper, HermeticWizard, and CaddyWiper destructive malware, all of which have been deployed against Ukraine since January 2022. Enable strong spam filters to prevent phishing emails from reaching end users.Set antivirus and antimalware programs to conduct regular scans.

Apache spyware on mac