SlideShare a Scribd company logo

A look at current cyberattacks in Ukraine

•Download as PPTX, PDF•
•
Kaspersky
Kaspersky

Kaspersky researchers have been monitoring the activity of APT actors, cybercriminals and hacktivists currently involved in the conflict in Ukraine. During this webinar, the Global Research and Analysis Team (GReAT) will share their findings on the most recent cyberattacks targeting Ukraine and present their observations, analysis and top findings. - The types of attacks that have been targeting Ukraine for the past few months - The results of analysis on destructive attacks and malware (HermeticWiper, etc...) - How organizations can defend themselves against cyberattacks GReAT, Kaspersky’s Global Research and Analysis Team, consists of 40 researchers based around the world that work on uncovering APTs, cyberespionage campaigns, major malware, ransomware and underground cybercriminal trends across the world.

Technology
1 of 37
2022 Webinar: Ukraine cyber attacks analysis Kurt Baumgartner, Dan Demeter Ivan Kwiatkowski, Marco Preuss, Costin Raiu Global Research and Analysis Team, Kaspersky
A historical overview of cyberattacks in Ukraine
3 | Historical overview of cyberattacks in Ukraine ● 2014 BlackEnergy APT - routers hack, elections ● Oct 2014 CyberBerkut leaks; Ukrainian Central Election Commission DDoS attacks ● Dec 2015 Powergrid attack - BlackEnergy3, KillDisk ● Dec 2016 Industroyer attack - ICS functionality ● Jun 2017 NotPetya attack - supply chain ● Oct 2017 BadRabbit attack - FlowerDandy framework ● 2018 - Hades cyberespionage ● 2019-2022 - spike in Gamaredon / Armageddon ops
4 | APT name First active Currently active in UA RedOctober 2007 No Dukes .. APT29 2013 Unknown Turla 2008 No Sofacy / APT28 2008 Yes CrouchingYeti / E.B. 2010 No BlackEnergy APT (BE2,3) 2013-2014 No Hades / Sandworm / Telebots 2015 Unknown Gamaredon 2013 Yes, highly active UNC1151 / Ghostwriter 2016 Yes Historical overview of cyberattacks in Ukraine
5 | Overview of current cyber activity in Ukraine Known APT activity
6 | Timeline of recent cyberattacks in Ukraine 21-23 Dec 2021 WhisperGate test variants Custom wiper being developed and tested. 28 Dec 2021 HermeticWiper compiled Sophisticated wiper being developed and final version compiled. 13 Jan 2022 WhisperGate deployed Custom wiper deployed on a low number of Ukraine organizations. 14 Jan 2022 Ukraine websites hack Multiple UA gov websites hacked to display that citizen data has been compromised. 23 Feb 2022 HermeticWiper, HermeticWizard, Hermetic Ransom Sophisticated destructive malware deployed on Ukraine organizations. 24 Feb 2022 IsaacWiper Another custom wiper deployed in UA gov networks.
Network level attacks
8 | Honeypots Total: 20,905 unique attacking IP addresses of which 11,735 were only observed at UA-Sensors (so far)
9 | Daily malicious sessions
10 | Source IP Geolocation Origin Hits China 4090 United States 2147 Russian Federation 470 India 414 United Kingdom 373 Singapore 333 Germany 294 Korea, Republic of 260 Netherlands 248 Others 3097
11 | Attacked services (ports) Rank Port Service 1 23 Telnet 2 22 SSH 3 80 HTTP 4 465 SMTP over TLS 5 21 FTP 6 25 SMTP 7 443 HTTPS 10 8080 Apache Tomcat 11 6379 Redis Database 12 8443 Apache Tomcat 13 8081 alternative HTTP 14 9000 different IoT-Devices/Router 15 7547 TR-069 (Router remote control) 18 37215 Router 21 10000 ICS related, div. Management Software 23 49152 different IoT-Devices/Routers 26 37777 IP-Camera
12 | Attacked services (credentials) Username Service gpadmin Greenplum Database nagios Nagios Monitoring tomcat Tomcat (webserver) smmsp Sendmail netscreen Router CUAdmin Voicemail&Messaging yhtcAdmin Modem gdcuadmin Router e8ehome1 Router TMAR#DLKT20060205 Router nmgcuadmin Router
13 | Attacked services (paths) Path Service cgi-bin/hi3510/param.cgi IP Camera global-....../login.esp Management Solution wp-content/plugins Wordpress CMS phpMyAdmin/index.php phpMyAdmin laravel/vendor/ laravel (PHP Framework) -unspecified- OWA /zabbix/ IT Monitoring System /remote/fgt Firewall management luci-static/top-iot OpenWRT Router UI com.atlassian.jira/jira-webapp-dist Project Management microsoft.exchange. Microsoft Exchange
14 | IOCs We will share collected IOCs publicly after the webinar.
Known and unknown APT attacks • Gamaredon • Hades/Sandorm - CyclopsBlink • PandoraBlade • Unknown attacks relying on commodity malware / RATs
16 | Gamaredon
17 | Gamaredon ● Seemingly low urgency offensive efforts (lack of 0day, technical capability) ● Highly active ● Changing, clumsy, low tech malware set ○ Macro-enabled malicious documents ○ Multi-stage infection and process initiation chain - malicious LNK via removable/network drives, Powershell, scheduled tasks, VBScripts, Sfx executables ○ modified uVNC, DStealer (custom filestealer, June/July 2021 peak) ○ Simple http communications ● Targeting in waves - every couple months ● Targeting profiles include: ○ Telecoms ○ Court systems, law enforcement (anti-corruption related)
18 | Gamaredon ● Inexpensive, minor changes in infection chain into 2022 ● malicious LNK, VBScript, scheduled tasks, malicious HTA ● Re-use of “desktop.ini” filename since 2017 (used for 2017 configuration files) ○ Sept 2021 - March 2022 “desktop.ini” use - obfuscated vbscript delivery via removable drives
19 | Gamaredon ● Interesting overlap with CERT-UA incident here (dependency on LNK -> VBScript “desktop.ini” process initiation chain) https://cert.gov.ua/article/37626, https://media.kasperskycontenthub.com/wp- content/uploads/sites/43/2018/03/08083618/themysteryofthepdf0-dayassemblermicrobackdoor.pdf
20 | Cyclops Blink, Hades/Sandworm https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
21 | Pandora RAT / PandoraBlade ● Spearphishing campaigns ● Запит від СБУ (виконання до 25.02.2022).rar ● “План евакуації (затверджений СБУ 28.02.2022 Наказом № 009363677833).rar”, which can be roughly translated to “Evacuation plan (approved by the Security Service of Ukraine on February 28, 2022 by Order No. 009363677833)”
22 | Other examples feukslpost.mil.gov.ua.zip n.lashevychdirekcy.atom.gov.ua.zip sadovska-iiutg.ua.zip pumbaarbitr.gov.ua.rar ...
23 | MicroBackdoor (UNC1151?) довідка.zip -> dovidka.chm
Wipers, fake ransomware • WhisperGate • HermeticWiper • IsaacWiper • HermeticRansom
25 | WhisperGate
26 | IsaacWiper
27 | HermeticRansom / PartyTicket / Elections GoRansom
28 | HermeticWiper + HermeticWizard Image source: MalwareBytes - Digitally signed - Abuses a legitimate driver - Data fragmentation - Very complex NTFS parsing - Independent spreading utility
Unknown or unattributed attacks • Viasat / satellite hacks
● On Feb 24th, around 4am UTC, thousands of Viasat satellite modems (eg. Surfbeam 2) stopped working ● Modems are “bricked”, lights won’t turn on ● Collateral damage ● Result of “cyber event”. LEA investigating.
● “Viasat is experiencing a partial network outage — impacting internet service for fixed broadband customers in Ukraine and elsewhere on our European KA-SAT network,” ● Viasat provides KA-SAT service ● 5,800 of Enercon’s turbines, with 11GW of total capacity, have been affected ● Overall 30,000+ terminals in Europe were believed to have been affected ● Timing makes it unlikely to be a “random occurrence” ● Possible causes: ○ Malicious update ○ Remote hack / 0-day via SAT ○ Remote hack via internet ○ Collateral damage from other ops The Viasat “cyber event”
Hacktivism and cybercriminals turned hacktivists
33 | Hacktivism and cybercriminals turned hacktivists
34 | Raidforums, Cyber-Partisans, IT ARMY of Ukraine
35 | Hacktivists & other parties Open UA support Open RU support Neutral RaidForums Conti ransomware Lockbit ransomware Anonymous collective CoomingProject ransomware ALPHV ransomware IT ARMY of Ukraine Stormous ransomware Belarusian Cyber-Partisans KILLNET AgainstTheWest NB65 Squad303 Kelvinsecurity + ...
36 | Summary and outlook ● We expect the number of cyber attacks in Ukraine will increase during the next 6 months ● Most of the current attacks are low complexity - to hinder attribution? ○ DDoS attacks, commodity rats ● More sophisticated attacks exist as well ○ Viasat “cyber event” ○ HermeticWiper ● The risk of the conflict spilling into the west is medium-high ● Most active APT groups - Gamaredon, UNC1151 ● Companies need to take typical measures against: ○ DDoS attacks and network connectivity, ransomware and destructive malware (backups), phishing (MFA), targeted attacks, supply chain attacks, firmware attacks ● Integrate Threat Intelligence into SOC, EDR ○ Leverage IOCs, Yara, Suricata and Sigma rules
Thank you!

Recommended

Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
Arpan Raval
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
Bhushan Gurav
 
Cyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightCyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to Insight
Deep Shankar Yadav
 
OSINT for Attack and Defense
OSINT for Attack and DefenseOSINT for Attack and Defense
OSINT for Attack and Defense
Andrew McNicol
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
n|u - The Open Security Community
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metrics
Mark Arena
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
MITRE - ATT&CKcon
 
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchUsing MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
MITRE - ATT&CKcon
 

Recommended

Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
Arpan Raval
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
Bhushan Gurav
 
Cyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightCyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to Insight
Deep Shankar Yadav
 
OSINT for Attack and Defense
OSINT for Attack and DefenseOSINT for Attack and Defense
OSINT for Attack and Defense
Andrew McNicol
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
n|u - The Open Security Community
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metrics
Mark Arena
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
MITRE - ATT&CKcon
 
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchUsing MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
MITRE - ATT&CKcon
 
Security Strategy and Tactic with Cyber Threat Intelligence (CTI)
Security Strategy and Tactic with Cyber Threat Intelligence (CTI)Security Strategy and Tactic with Cyber Threat Intelligence (CTI)
Security Strategy and Tactic with Cyber Threat Intelligence (CTI)
Priyanka Aash
 
OSINT: Open Source Intelligence gathering
OSINT: Open Source Intelligence gatheringOSINT: Open Source Intelligence gathering
OSINT: Open Source Intelligence gathering
Jeremiah Tillman
 
Application Security - Dont leave your AppSec for the last moment Meetup 2104...
Application Security - Dont leave your AppSec for the last moment Meetup 2104...Application Security - Dont leave your AppSec for the last moment Meetup 2104...
Application Security - Dont leave your AppSec for the last moment Meetup 2104...
lior mazor
 
Threat Hunting Workshop
Threat Hunting WorkshopThreat Hunting Workshop
Threat Hunting Workshop
Splunk
 
Cybersecurity
CybersecurityCybersecurity
Cybersecurity
Edwin A. Opare
 
Welcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceWelcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat Intelligence
Andreas Sfakianakis
 
The importance of Cybersecurity
The importance of CybersecurityThe importance of Cybersecurity
The importance of Cybersecurity
Benoit Callebaut
 
Threat Hunting with Data Science
Threat Hunting with Data ScienceThreat Hunting with Data Science
Threat Hunting with Data Science
Austin Taylor
 
Cybersecurity Incident Management Powerpoint Presentation Slides
Cybersecurity Incident Management Powerpoint Presentation SlidesCybersecurity Incident Management Powerpoint Presentation Slides
Cybersecurity Incident Management Powerpoint Presentation Slides
SlideTeam
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
OWASP Delhi
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
mohamed nasri
 
Network security - Defense in Depth
Network security - Defense in DepthNetwork security - Defense in Depth
Network security - Defense in Depth
Dilum Bandara
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
ISO21434_public2.pdf
ISO21434_public2.pdfISO21434_public2.pdf
ISO21434_public2.pdf
MdZahirulIslamPhD
 
Sony Playstation Hack Presentation
Sony Playstation Hack PresentationSony Playstation Hack Presentation
Sony Playstation Hack Presentation
CreditCardFinder
 
Cyber Resilience
Cyber ResilienceCyber Resilience
Cyber Resilience
Ian-Edward Stafrace
 
API Security Fundamentals
API Security FundamentalsAPI Security Fundamentals
API Security Fundamentals
José Haro Peralta
 
SOAR and SIEM.pptx
SOAR and SIEM.pptxSOAR and SIEM.pptx
SOAR and SIEM.pptx
Ajit Wadhawan
 
IoT - the Next Wave of DDoS Threat Landscape
IoT - the Next Wave of DDoS Threat LandscapeIoT - the Next Wave of DDoS Threat Landscape
IoT - the Next Wave of DDoS Threat Landscape
APNIC
 
Exploring Risk and Mapping the Internet of Things with Autonomous Drones
Exploring Risk and Mapping the Internet of Things with Autonomous DronesExploring Risk and Mapping the Internet of Things with Autonomous Drones
Exploring Risk and Mapping the Internet of Things with Autonomous Drones
Praetorian
 

More Related Content

What's hot

Welcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceWelcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat Intelligence
Andreas Sfakianakis
 
Threat Hunting with Data Science
Threat Hunting with Data ScienceThreat Hunting with Data Science
Threat Hunting with Data Science
Austin Taylor
 
Cybersecurity Incident Management Powerpoint Presentation Slides
Cybersecurity Incident Management Powerpoint Presentation SlidesCybersecurity Incident Management Powerpoint Presentation Slides
Cybersecurity Incident Management Powerpoint Presentation Slides
SlideTeam
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout
 

What's hot (20)

Security Strategy and Tactic with Cyber Threat Intelligence (CTI)
Security Strategy and Tactic with Cyber Threat Intelligence (CTI)Security Strategy and Tactic with Cyber Threat Intelligence (CTI)
Security Strategy and Tactic with Cyber Threat Intelligence (CTI)
 
OSINT: Open Source Intelligence gathering
OSINT: Open Source Intelligence gatheringOSINT: Open Source Intelligence gathering
OSINT: Open Source Intelligence gathering
 
Application Security - Dont leave your AppSec for the last moment Meetup 2104...
Application Security - Dont leave your AppSec for the last moment Meetup 2104...Application Security - Dont leave your AppSec for the last moment Meetup 2104...
Application Security - Dont leave your AppSec for the last moment Meetup 2104...
 
Threat Hunting Workshop
Threat Hunting WorkshopThreat Hunting Workshop
Threat Hunting Workshop
 
Cybersecurity
CybersecurityCybersecurity
Cybersecurity
 
Welcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceWelcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat Intelligence
 
The importance of Cybersecurity
The importance of CybersecurityThe importance of Cybersecurity
The importance of Cybersecurity
 
Threat Hunting with Data Science
Threat Hunting with Data ScienceThreat Hunting with Data Science
Threat Hunting with Data Science
 
Cybersecurity Incident Management Powerpoint Presentation Slides
Cybersecurity Incident Management Powerpoint Presentation SlidesCybersecurity Incident Management Powerpoint Presentation Slides
Cybersecurity Incident Management Powerpoint Presentation Slides
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
Network security - Defense in Depth
Network security - Defense in DepthNetwork security - Defense in Depth
Network security - Defense in Depth
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
 
ISO21434_public2.pdf
ISO21434_public2.pdfISO21434_public2.pdf
ISO21434_public2.pdf
 
Sony Playstation Hack Presentation
Sony Playstation Hack PresentationSony Playstation Hack Presentation
Sony Playstation Hack Presentation
 
Cyber Resilience
Cyber ResilienceCyber Resilience
Cyber Resilience
 
API Security Fundamentals
API Security FundamentalsAPI Security Fundamentals
API Security Fundamentals
 
SOAR and SIEM.pptx
SOAR and SIEM.pptxSOAR and SIEM.pptx
SOAR and SIEM.pptx
 

Similar to A look at current cyberattacks in Ukraine

Exploring Risk and Mapping the Internet of Things with Autonomous Drones
Exploring Risk and Mapping the Internet of Things with Autonomous DronesExploring Risk and Mapping the Internet of Things with Autonomous Drones
Exploring Risk and Mapping the Internet of Things with Autonomous Drones
Praetorian
 
[cb22] CloudDragon’s Credential Factory is Powering Up Its Espionage Activiti...
[cb22] CloudDragon’s Credential Factory is Powering Up Its Espionage Activiti...[cb22] CloudDragon’s Credential Factory is Powering Up Its Espionage Activiti...
[cb22] CloudDragon’s Credential Factory is Powering Up Its Espionage Activiti...
CODE BLUE
 

Similar to A look at current cyberattacks in Ukraine (20)

IoT - the Next Wave of DDoS Threat Landscape
IoT - the Next Wave of DDoS Threat LandscapeIoT - the Next Wave of DDoS Threat Landscape
IoT - the Next Wave of DDoS Threat Landscape
 
Exploring Risk and Mapping the Internet of Things with Autonomous Drones
Exploring Risk and Mapping the Internet of Things with Autonomous DronesExploring Risk and Mapping the Internet of Things with Autonomous Drones
Exploring Risk and Mapping the Internet of Things with Autonomous Drones
 
Greater China Cyber Threat Landscape - ISC 2016
Greater China Cyber Threat Landscape - ISC 2016Greater China Cyber Threat Landscape - ISC 2016
Greater China Cyber Threat Landscape - ISC 2016
 
Arbor Presentation
Arbor Presentation Arbor Presentation
Arbor Presentation
 
[CB20] Cleaning up the mess: discovery, monitoring, analysis, and notificatio...
[CB20] Cleaning up the mess: discovery, monitoring, analysis, and notificatio...[CB20] Cleaning up the mess: discovery, monitoring, analysis, and notificatio...
[CB20] Cleaning up the mess: discovery, monitoring, analysis, and notificatio...
 
[Hitcon 2019] Some things about recent Internet IoT/ICS attacks - a perspecti...
[Hitcon 2019] Some things about recent Internet IoT/ICS attacks - a perspecti...[Hitcon 2019] Some things about recent Internet IoT/ICS attacks - a perspecti...
[Hitcon 2019] Some things about recent Internet IoT/ICS attacks - a perspecti...
 
Fortinet ixia ottawa, june 2013
Fortinet ixia ottawa, june 2013Fortinet ixia ottawa, june 2013
Fortinet ixia ottawa, june 2013
 
[cb22] CloudDragon’s Credential Factory is Powering Up Its Espionage Activiti...
[cb22] CloudDragon’s Credential Factory is Powering Up Its Espionage Activiti...[cb22] CloudDragon’s Credential Factory is Powering Up Its Espionage Activiti...
[cb22] CloudDragon’s Credential Factory is Powering Up Its Espionage Activiti...
 
SecurityGen GTP Vulnerabilities.pptx
SecurityGen GTP Vulnerabilities.pptxSecurityGen GTP Vulnerabilities.pptx
SecurityGen GTP Vulnerabilities.pptx
 
DDoS Attack on DNS using infected IoT Devices
DDoS Attack on DNS using infected IoT DevicesDDoS Attack on DNS using infected IoT Devices
DDoS Attack on DNS using infected IoT Devices
 
Avast @ Machine Learning
Avast @ Machine LearningAvast @ Machine Learning
Avast @ Machine Learning
 
Security PWNing 2018 - Penthertz: The use of radio attacks during redteam tests
Security PWNing 2018 - Penthertz: The use of radio attacks during redteam testsSecurity PWNing 2018 - Penthertz: The use of radio attacks during redteam tests
Security PWNing 2018 - Penthertz: The use of radio attacks during redteam tests
 
Secured Internet Gateway for ISP with pfsense & FRR
Secured Internet Gateway for ISP with pfsense & FRRSecured Internet Gateway for ISP with pfsense & FRR
Secured Internet Gateway for ISP with pfsense & FRR
 
Russia the threat landscape
Russia the threat landscapeRussia the threat landscape
Russia the threat landscape
 
IRJET- Network Monitoring & Network Security
IRJET- Network Monitoring & Network SecurityIRJET- Network Monitoring & Network Security
IRJET- Network Monitoring & Network Security
 
IoT Security - Preparing for the Worst
IoT Security - Preparing for the WorstIoT Security - Preparing for the Worst
IoT Security - Preparing for the Worst
 
How Red Hat ran a global OpenVPN offer during the COVID-19 pandemic with 99% ...
How Red Hat ran a global OpenVPN offer during the COVID-19 pandemic with 99% ...How Red Hat ran a global OpenVPN offer during the COVID-19 pandemic with 99% ...
How Red Hat ran a global OpenVPN offer during the COVID-19 pandemic with 99% ...
 
Next Dimension and Cisco | Solutions for PIPEDA Compliance
Next Dimension and Cisco | Solutions for PIPEDA ComplianceNext Dimension and Cisco | Solutions for PIPEDA Compliance
Next Dimension and Cisco | Solutions for PIPEDA Compliance
 
Evolutionary ATM & Cyber Security - Selex ES - Angeloluca Barba
Evolutionary ATM & Cyber Security - Selex ES - Angeloluca BarbaEvolutionary ATM & Cyber Security - Selex ES - Angeloluca Barba
Evolutionary ATM & Cyber Security - Selex ES - Angeloluca Barba
 
DEFCON 23 Why Nation-State Malwares Target Telco Networks - OMER COSKUN
DEFCON 23 Why Nation-State Malwares Target Telco Networks - OMER COSKUNDEFCON 23 Why Nation-State Malwares Target Telco Networks - OMER COSKUN
DEFCON 23 Why Nation-State Malwares Target Telco Networks - OMER COSKUN
 

More from Kaspersky

The Log4Shell Vulnerability – explained: how to stay secure
The Log4Shell Vulnerability – explained: how to stay secureThe Log4Shell Vulnerability – explained: how to stay secure
The Log4Shell Vulnerability – explained: how to stay secure
Kaspersky
 
The Log4Shell Vulnerability – explained: how to stay secure
The Log4Shell Vulnerability – explained: how to stay secureThe Log4Shell Vulnerability – explained: how to stay secure
The Log4Shell Vulnerability – explained: how to stay secure
Kaspersky
 
Алексей Гуревич. Кибербезопасность систем управления современных объектов эле...
Алексей Гуревич. Кибербезопасность систем управления современных объектов эле...Алексей Гуревич. Кибербезопасность систем управления современных объектов эле...
Алексей Гуревич. Кибербезопасность систем управления современных объектов эле...
Kaspersky
 
Максим Бородько. Спуфинг GNSS — новая угроза для критической инфраструктуры
Максим Бородько. Спуфинг GNSS — новая угроза для критической инфраструктурыМаксим Бородько. Спуфинг GNSS — новая угроза для критической инфраструктуры
Максим Бородько. Спуфинг GNSS — новая угроза для критической инфраструктуры
Kaspersky
 
Дмитрий Правиков. Концепция информационной безопасности «роя» киберфизических...
Дмитрий Правиков. Концепция информационной безопасности «роя» киберфизических...Дмитрий Правиков. Концепция информационной безопасности «роя» киберфизических...
Дмитрий Правиков. Концепция информационной безопасности «роя» киберфизических...
Kaspersky
 
Андрей Суворов, Максим Карпухин. Сенсация под микроскопом. Вивисекция первого...
Андрей Суворов, Максим Карпухин. Сенсация под микроскопом. Вивисекция первого...Андрей Суворов, Максим Карпухин. Сенсация под микроскопом. Вивисекция первого...
Андрей Суворов, Максим Карпухин. Сенсация под микроскопом. Вивисекция первого...
Kaspersky
 
Игорь Рыжов. Проекты по защите АСУ ТП вчера, сегодня, завтра
Игорь Рыжов. Проекты по защите АСУ ТП вчера, сегодня, завтраИгорь Рыжов. Проекты по защите АСУ ТП вчера, сегодня, завтра
Игорь Рыжов. Проекты по защите АСУ ТП вчера, сегодня, завтра
Kaspersky
 
Александр Карпенко. Уровни зрелости АСУ ТП как объектов защиты и подходы к ун...
Александр Карпенко. Уровни зрелости АСУ ТП как объектов защиты и подходы к ун...Александр Карпенко. Уровни зрелости АСУ ТП как объектов защиты и подходы к ун...
Александр Карпенко. Уровни зрелости АСУ ТП как объектов защиты и подходы к ун...
Kaspersky
 
Марина Сорокина. Криптография для промышленных систем
Марина Сорокина. Криптография для промышленных системМарина Сорокина. Криптография для промышленных систем
Марина Сорокина. Криптография для промышленных систем
Kaspersky
 
Александр Волошин. Киберполигон "Цифровая энергетика". Исследования и разрабо...
Александр Волошин. Киберполигон "Цифровая энергетика". Исследования и разрабо...Александр Волошин. Киберполигон "Цифровая энергетика". Исследования и разрабо...
Александр Волошин. Киберполигон "Цифровая энергетика". Исследования и разрабо...
Kaspersky
 
Евгений Дружинин. Как не сломать: что важно учесть перед, в ходе и после реал...
Евгений Дружинин. Как не сломать: что важно учесть перед, в ходе и после реал...Евгений Дружинин. Как не сломать: что важно учесть перед, в ходе и после реал...
Евгений Дружинин. Как не сломать: что важно учесть перед, в ходе и после реал...
Kaspersky
 
Алексей Иванов. Реализация проектов АСУ ТП электрических подстанций ​в соотве...
Алексей Иванов. Реализация проектов АСУ ТП электрических подстанций ​в соотве...Алексей Иванов. Реализация проектов АСУ ТП электрических подстанций ​в соотве...
Алексей Иванов. Реализация проектов АСУ ТП электрических подстанций ​в соотве...
Kaspersky
 
Олег Шакиров. Дипломатия и защита критической инфраструктуры от киберугроз
Олег Шакиров. Дипломатия и защита критической инфраструктуры от киберугрозОлег Шакиров. Дипломатия и защита критической инфраструктуры от киберугроз
Олег Шакиров. Дипломатия и защита критической инфраструктуры от киберугроз
Kaspersky
 

More from Kaspersky (20)

The Log4Shell Vulnerability – explained: how to stay secure
The Log4Shell Vulnerability – explained: how to stay secureThe Log4Shell Vulnerability – explained: how to stay secure
The Log4Shell Vulnerability – explained: how to stay secure
 
The Log4Shell Vulnerability – explained: how to stay secure
The Log4Shell Vulnerability – explained: how to stay secureThe Log4Shell Vulnerability – explained: how to stay secure
The Log4Shell Vulnerability – explained: how to stay secure
 
Алексей Гуревич. Кибербезопасность систем управления современных объектов эле...
Алексей Гуревич. Кибербезопасность систем управления современных объектов эле...Алексей Гуревич. Кибербезопасность систем управления современных объектов эле...
Алексей Гуревич. Кибербезопасность систем управления современных объектов эле...
 
Максим Бородько. Спуфинг GNSS — новая угроза для критической инфраструктуры
Максим Бородько. Спуфинг GNSS — новая угроза для критической инфраструктурыМаксим Бородько. Спуфинг GNSS — новая угроза для критической инфраструктуры
Максим Бородько. Спуфинг GNSS — новая угроза для критической инфраструктуры
 
Кирилл Набойщиков. Системный подход к защите КИИ
Кирилл Набойщиков. Системный подход к защите КИИКирилл Набойщиков. Системный подход к защите КИИ
Кирилл Набойщиков. Системный подход к защите КИИ
 
Вениамин Левцов. Cтратегия трансформации решений Лаборатории Касперского для ...
Вениамин Левцов. Cтратегия трансформации решений Лаборатории Касперского для ...Вениамин Левцов. Cтратегия трансформации решений Лаборатории Касперского для ...
Вениамин Левцов. Cтратегия трансформации решений Лаборатории Касперского для ...
 
Джан Демирел (Турция). Текущий статус регулирования промышленной кибербезопас...
Джан Демирел (Турция). Текущий статус регулирования промышленной кибербезопас...Джан Демирел (Турция). Текущий статус регулирования промышленной кибербезопас...
Джан Демирел (Турция). Текущий статус регулирования промышленной кибербезопас...
 
Мария Гарнаева. Целевые атаки на промышленные компании в 2020/2021
Мария Гарнаева. Целевые атаки на промышленные компании в 2020/2021Мария Гарнаева. Целевые атаки на промышленные компании в 2020/2021
Мария Гарнаева. Целевые атаки на промышленные компании в 2020/2021
 
Дмитрий Правиков. Концепция информационной безопасности «роя» киберфизических...
Дмитрий Правиков. Концепция информационной безопасности «роя» киберфизических...Дмитрий Правиков. Концепция информационной безопасности «роя» киберфизических...
Дмитрий Правиков. Концепция информационной безопасности «роя» киберфизических...
 
Андрей Суворов, Максим Карпухин. Сенсация под микроскопом. Вивисекция первого...
Андрей Суворов, Максим Карпухин. Сенсация под микроскопом. Вивисекция первого...Андрей Суворов, Максим Карпухин. Сенсация под микроскопом. Вивисекция первого...
Андрей Суворов, Максим Карпухин. Сенсация под микроскопом. Вивисекция первого...
 
Глеб Дьяконов. ИИ-видеоаналитика как инструмент корпоративного риск-менеджмен...
Глеб Дьяконов. ИИ-видеоаналитика как инструмент корпоративного риск-менеджмен...Глеб Дьяконов. ИИ-видеоаналитика как инструмент корпоративного риск-менеджмен...
Глеб Дьяконов. ИИ-видеоаналитика как инструмент корпоративного риск-менеджмен...
 
Игорь Рыжов. Проекты по защите АСУ ТП вчера, сегодня, завтра
Игорь Рыжов. Проекты по защите АСУ ТП вчера, сегодня, завтраИгорь Рыжов. Проекты по защите АСУ ТП вчера, сегодня, завтра
Игорь Рыжов. Проекты по защите АСУ ТП вчера, сегодня, завтра
 
Александр Карпенко. Уровни зрелости АСУ ТП как объектов защиты и подходы к ун...
Александр Карпенко. Уровни зрелости АСУ ТП как объектов защиты и подходы к ун...Александр Карпенко. Уровни зрелости АСУ ТП как объектов защиты и подходы к ун...
Александр Карпенко. Уровни зрелости АСУ ТП как объектов защиты и подходы к ун...
 
Марина Сорокина. Криптография для промышленных систем
Марина Сорокина. Криптография для промышленных системМарина Сорокина. Криптография для промышленных систем
Марина Сорокина. Криптография для промышленных систем
 
Александр Лифанов. Платформа граничных вычислений Siemens Industrial Edge: пе...
Александр Лифанов. Платформа граничных вычислений Siemens Industrial Edge: пе...Александр Лифанов. Платформа граничных вычислений Siemens Industrial Edge: пе...
Александр Лифанов. Платформа граничных вычислений Siemens Industrial Edge: пе...
 
Александр Волошин. Киберполигон "Цифровая энергетика". Исследования и разрабо...
Александр Волошин. Киберполигон "Цифровая энергетика". Исследования и разрабо...Александр Волошин. Киберполигон "Цифровая энергетика". Исследования и разрабо...
Александр Волошин. Киберполигон "Цифровая энергетика". Исследования и разрабо...
 
Евгений Дружинин. Как не сломать: что важно учесть перед, в ходе и после реал...
Евгений Дружинин. Как не сломать: что важно учесть перед, в ходе и после реал...Евгений Дружинин. Как не сломать: что важно учесть перед, в ходе и после реал...
Евгений Дружинин. Как не сломать: что важно учесть перед, в ходе и после реал...
 
Алексей Иванов. Реализация проектов АСУ ТП электрических подстанций ​в соотве...
Алексей Иванов. Реализация проектов АСУ ТП электрических подстанций ​в соотве...Алексей Иванов. Реализация проектов АСУ ТП электрических подстанций ​в соотве...
Алексей Иванов. Реализация проектов АСУ ТП электрических подстанций ​в соотве...
 
Олег Шакиров. Дипломатия и защита критической инфраструктуры от киберугроз
Олег Шакиров. Дипломатия и защита критической инфраструктуры от киберугрозОлег Шакиров. Дипломатия и защита критической инфраструктуры от киберугроз
Олег Шакиров. Дипломатия и защита критической инфраструктуры от киберугроз
 
Василий Шауро. Развитие кибербезопасности АСУТП ​в условиях цифровизации пред...
Василий Шауро. Развитие кибербезопасности АСУТП ​в условиях цифровизации пред...Василий Шауро. Развитие кибербезопасности АСУТП ​в условиях цифровизации пред...
Василий Шауро. Развитие кибербезопасности АСУТП ​в условиях цифровизации пред...
 

Recently uploaded

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc
 
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsTop 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Roshan Dwivedi
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Safe Software
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
sammart93
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
panagenda
 

Recently uploaded (20)

HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation Strategies
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsTop 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
 
Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 

A look at current cyberattacks in Ukraine

  • 1. 2022 Webinar: Ukraine cyber attacks analysis Kurt Baumgartner, Dan Demeter Ivan Kwiatkowski, Marco Preuss, Costin Raiu Global Research and Analysis Team, Kaspersky
  • 2. A historical overview of cyberattacks in Ukraine
  • 3. 3 | Historical overview of cyberattacks in Ukraine ● 2014 BlackEnergy APT - routers hack, elections ● Oct 2014 CyberBerkut leaks; Ukrainian Central Election Commission DDoS attacks ● Dec 2015 Powergrid attack - BlackEnergy3, KillDisk ● Dec 2016 Industroyer attack - ICS functionality ● Jun 2017 NotPetya attack - supply chain ● Oct 2017 BadRabbit attack - FlowerDandy framework ● 2018 - Hades cyberespionage ● 2019-2022 - spike in Gamaredon / Armageddon ops
  • 4. 4 | APT name First active Currently active in UA RedOctober 2007 No Dukes .. APT29 2013 Unknown Turla 2008 No Sofacy / APT28 2008 Yes CrouchingYeti / E.B. 2010 No BlackEnergy APT (BE2,3) 2013-2014 No Hades / Sandworm / Telebots 2015 Unknown Gamaredon 2013 Yes, highly active UNC1151 / Ghostwriter 2016 Yes Historical overview of cyberattacks in Ukraine
  • 5. 5 | Overview of current cyber activity in Ukraine Known APT activity
  • 6. 6 | Timeline of recent cyberattacks in Ukraine 21-23 Dec 2021 WhisperGate test variants Custom wiper being developed and tested. 28 Dec 2021 HermeticWiper compiled Sophisticated wiper being developed and final version compiled. 13 Jan 2022 WhisperGate deployed Custom wiper deployed on a low number of Ukraine organizations. 14 Jan 2022 Ukraine websites hack Multiple UA gov websites hacked to display that citizen data has been compromised. 23 Feb 2022 HermeticWiper, HermeticWizard, Hermetic Ransom Sophisticated destructive malware deployed on Ukraine organizations. 24 Feb 2022 IsaacWiper Another custom wiper deployed in UA gov networks.
  • 8. 8 | Honeypots Total: 20,905 unique attacking IP addresses of which 11,735 were only observed at UA-Sensors (so far)
  • 10. 10 | Source IP Geolocation Origin Hits China 4090 United States 2147 Russian Federation 470 India 414 United Kingdom 373 Singapore 333 Germany 294 Korea, Republic of 260 Netherlands 248 Others 3097
  • 11. 11 | Attacked services (ports) Rank Port Service 1 23 Telnet 2 22 SSH 3 80 HTTP 4 465 SMTP over TLS 5 21 FTP 6 25 SMTP 7 443 HTTPS 10 8080 Apache Tomcat 11 6379 Redis Database 12 8443 Apache Tomcat 13 8081 alternative HTTP 14 9000 different IoT-Devices/Router 15 7547 TR-069 (Router remote control) 18 37215 Router 21 10000 ICS related, div. Management Software 23 49152 different IoT-Devices/Routers 26 37777 IP-Camera
  • 12. 12 | Attacked services (credentials) Username Service gpadmin Greenplum Database nagios Nagios Monitoring tomcat Tomcat (webserver) smmsp Sendmail netscreen Router CUAdmin Voicemail&Messaging yhtcAdmin Modem gdcuadmin Router e8ehome1 Router TMAR#DLKT20060205 Router nmgcuadmin Router
  • 13. 13 | Attacked services (paths) Path Service cgi-bin/hi3510/param.cgi IP Camera global-....../login.esp Management Solution wp-content/plugins Wordpress CMS phpMyAdmin/index.php phpMyAdmin laravel/vendor/ laravel (PHP Framework) -unspecified- OWA /zabbix/ IT Monitoring System /remote/fgt Firewall management luci-static/top-iot OpenWRT Router UI com.atlassian.jira/jira-webapp-dist Project Management microsoft.exchange. Microsoft Exchange
  • 14. 14 | IOCs We will share collected IOCs publicly after the webinar.
  • 15. Known and unknown APT attacks • Gamaredon • Hades/Sandorm - CyclopsBlink • PandoraBlade • Unknown attacks relying on commodity malware / RATs
  • 17. 17 | Gamaredon ● Seemingly low urgency offensive efforts (lack of 0day, technical capability) ● Highly active ● Changing, clumsy, low tech malware set ○ Macro-enabled malicious documents ○ Multi-stage infection and process initiation chain - malicious LNK via removable/network drives, Powershell, scheduled tasks, VBScripts, Sfx executables ○ modified uVNC, DStealer (custom filestealer, June/July 2021 peak) ○ Simple http communications ● Targeting in waves - every couple months ● Targeting profiles include: ○ Telecoms ○ Court systems, law enforcement (anti-corruption related)
  • 18. 18 | Gamaredon ● Inexpensive, minor changes in infection chain into 2022 ● malicious LNK, VBScript, scheduled tasks, malicious HTA ● Re-use of “desktop.ini” filename since 2017 (used for 2017 configuration files) ○ Sept 2021 - March 2022 “desktop.ini” use - obfuscated vbscript delivery via removable drives
  • 19. 19 | Gamaredon ● Interesting overlap with CERT-UA incident here (dependency on LNK -> VBScript “desktop.ini” process initiation chain) https://cert.gov.ua/article/37626, https://media.kasperskycontenthub.com/wp- content/uploads/sites/43/2018/03/08083618/themysteryofthepdf0-dayassemblermicrobackdoor.pdf
  • 20. 20 | Cyclops Blink, Hades/Sandworm https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
  • 21. 21 | Pandora RAT / PandoraBlade ● Spearphishing campaigns ● Запит від СБУ (виконання до 25.02.2022).rar ● “План евакуації (затверджений СБУ 28.02.2022 Наказом № 009363677833).rar”, which can be roughly translated to “Evacuation plan (approved by the Security Service of Ukraine on February 28, 2022 by Order No. 009363677833)”
  • 24. Wipers, fake ransomware • WhisperGate • HermeticWiper • IsaacWiper • HermeticRansom
  • 27. 27 | HermeticRansom / PartyTicket / Elections GoRansom
  • 28. 28 | HermeticWiper + HermeticWizard Image source: MalwareBytes - Digitally signed - Abuses a legitimate driver - Data fragmentation - Very complex NTFS parsing - Independent spreading utility
  • 29. Unknown or unattributed attacks • Viasat / satellite hacks
  • 30. ● On Feb 24th, around 4am UTC, thousands of Viasat satellite modems (eg. Surfbeam 2) stopped working ● Modems are “bricked”, lights won’t turn on ● Collateral damage ● Result of “cyber event”. LEA investigating.
  • 31. ● “Viasat is experiencing a partial network outage — impacting internet service for fixed broadband customers in Ukraine and elsewhere on our European KA-SAT network,” ● Viasat provides KA-SAT service ● 5,800 of Enercon’s turbines, with 11GW of total capacity, have been affected ● Overall 30,000+ terminals in Europe were believed to have been affected ● Timing makes it unlikely to be a “random occurrence” ● Possible causes: ○ Malicious update ○ Remote hack / 0-day via SAT ○ Remote hack via internet ○ Collateral damage from other ops The Viasat “cyber event”
  • 33. 33 | Hacktivism and cybercriminals turned hacktivists
  • 34. 34 | Raidforums, Cyber-Partisans, IT ARMY of Ukraine
  • 35. 35 | Hacktivists & other parties Open UA support Open RU support Neutral RaidForums Conti ransomware Lockbit ransomware Anonymous collective CoomingProject ransomware ALPHV ransomware IT ARMY of Ukraine Stormous ransomware Belarusian Cyber-Partisans KILLNET AgainstTheWest NB65 Squad303 Kelvinsecurity + ...
  • 36. 36 | Summary and outlook ● We expect the number of cyber attacks in Ukraine will increase during the next 6 months ● Most of the current attacks are low complexity - to hinder attribution? ○ DDoS attacks, commodity rats ● More sophisticated attacks exist as well ○ Viasat “cyber event” ○ HermeticWiper ● The risk of the conflict spilling into the west is medium-high ● Most active APT groups - Gamaredon, UNC1151 ● Companies need to take typical measures against: ○ DDoS attacks and network connectivity, ransomware and destructive malware (backups), phishing (MFA), targeted attacks, supply chain attacks, firmware attacks ● Integrate Threat Intelligence into SOC, EDR ○ Leverage IOCs, Yara, Suricata and Sigma rules