Thread by @ericgeller

Notable point from ESET's thread about new data-wiping malware that it discovered on hundreds of computers in Ukraine today.

https://twitter.com/ESETresearch/status/1496581914769207298

Symantec seeing it too

https://twitter.com/threatintel/status/1496578746014437376

Symantec's Eric Chien tells me: "We are seeing the wiper across multiple organizations in different sectors in the Ukraine including finance and government organizations. The wiper uses a legitimate driver to gain low level hard disk access to wipe data."

"We haven't yet documented the full attack chain," Chien says, "but it is clear in some organizations they had credentialed access already."

Aligns with what ESET tweeted about Active Directory access.

Chien says Symantec is also seeing the wiper in Lithuania, "but at this time it isn't clear if these are distinct organizations."

These could be infections of Ukrainian companies with international offices.

Symantec hasn't seen attacks on companies based outside of Ukraine.

Jean-Ian Boutin, head of ESET's threat research team, says the wiper targeted "large organizations."

"The malware based on its time stamp was created two months ago, however it was deployed only today and we have seen it only in Ukraine."

ESET has seen "several organizations targeted" but isn't ready to provide numerical estimates, a spokesperson says. They've seen more than the two organizations cited by Symantec.

Symantec's Chien says the government organizations they're seeing targeted by the wiper are contractors involved in "supporting the military sector."

Number of targets likely to change rapidly as analysts review data. Symantec has seen 3 as of now, but don't read much into that.

#HermeticWiper

https://twitter.com/ESETresearch/status/1496614321442459655

As of now, Symantec has seen the wiper Ukraine, Latvia, and Lithuania, per a statement a few minutes ago from their PR team.

They reiterate that so far they've seen attacks on financial companies and government contractors. (Chien told me they're military contractors.)

Ukraine #HermeticWiper malware is "incredibly thorough," @juanandres_gs told me tonight. "It's got at least five or six different ways that it's trashing different aspects of the operating system."

"It makes WhisperGate look like it was written by script kiddies," he said.

#HermeticWiper will look for as many as 100 physical drives to erase, trash the Master Boot Record, trash user folders, trash the Windows Registry, and then target the filesystem "and actually try to wipe things by sector," Guerrero-Saade said.

The wiper exploits a Microsoft feature that configures settings across multiple computers on a network, so it's designed for networks where the attacker has that kind of broad access.

It's "fire-and-forget," Guerrero-Saade said, compared to WhisperGate, which needed more input.

Guerrero-Saade likened #HermeticWiper to Shamoon (Saudi Aramco hack) and Destover (Sony hack) in that it deploys and abuses a driver for a legitimate program (in this case, EaseUS Partition Manager) to bypass the normal obstacles to deep hard-drive control that malware faces.

#HermeticWiper also doesn't appear to work on Windows 10, Guerrero-Saade told me, which is fine for Ukraine, where most computers run older versions of Windows — in many cases, pirated versions.

https://twitter.com/GossiTheDog/status/1496619773601488908

Partition Master, not Partition Manager, sorry.

https://twitter.com/ericgeller/status/1496658068590977024

#HermeticWiper accepts command-line arguments, suggesting that the hackers could have deployed it via a script, according to CrowdStrike's @Adam_Cyber.

The two commands tell the malware:

(1) how long to stay asleep on a target before activating
(2) when to shut the PC down

Meyers called #HermeticWiper "pretty nasty" and noted that it disables a Windows security feature called Volume Shadow Copy, which creates backups of files. A lot of ransomware does this.

"It takes some care to make sure that it's going to make a big mess for the target."

New Symantec report on Ukraine #HermeticWiper malware:

"Sectors targeted included organizations in the financial, defense, aviation, and IT services sectors."

Ransomware deployed ("likely" as a decoy) in some cases.

symantec-enterprise-blogs.security.com/blogs/threat-i…

In case you're wondering where the malware's name comes from: Symantec says it's delivered "in the form of an executable file, which is signed by a certificate issued to Hermetica Digital Ltd. "

Initial #HermeticWiper analysis reports from:

ESET welivesecurity.com/2022/02/24/her…

SentinelOne sentinelone.com/labs/hermetic-…

Reuters interviewed the man whose small business's name was found in the code of the #HermeticWiper malware menacing Ukraine.

He says he has nothing to do with it.

reuters.com/world/europe/c…

https://twitter.com/pearswick/status/1496902418810171395

Juan Andrés is continuing to dig into the #HermeticWiper malware found in Ukraine

https://twitter.com/juanandres_gs/status/1496932273538871300?t=s33rcjcWTXeQfNMb4SliLQ&s=19