Locked Russian hackers use WinRAR to wipe Ukraine state agency’s data

[dEEpEst]

Russian hackers use WinRAR to wipe Ukraine state agency’s data

The Russian 'Sandworm' hacking group has been linked to an attack on Ukrainian state networks where WinRar was used to destroy data on government devices.

In a new advisory, the Ukrainian Government Computer Emergency Response Team (CERT-UA) says the Russian hackers used compromised VPN accounts that weren't protected with multi-factor authentication to access critical systems in Ukrainian state networks.

Once they gained access to the network, they employed scripts that wiped files on Windows and Linux machines using the WinRar archiving program.

As both the 'dd' command and WinRar are legitimate programs, the threat actors likely used them to bypass detection by security software.

 

CERT-UA says the incident is similar to another destructive attack that hit the Ukrainian state news agency "Ukrinform" in January 2023, also attributed to Sandworm.

"The method of implementation of the malicious plan, the IP addresses of the access subjects, as well as the fact of using a modified version of RoarBat testify to the similarity with the cyberattack on Ukrinform, information about which was published in the Telegram channel "CyberArmyofRussia_Reborn" on January 17, 2023." reads the CERT-UA advisory.

 

CERT-UA recommends that all critical organizations in the country reduce their attack surface, patch flaws, disable unneeded services, limit access to management interfaces, and monitor their network traffic and logs.

 

As always, VPN accounts that allow access to corporate networks should be protected with multi-factor authentication.

 

Source: 

This is the hidden content, please

• Sign In
• or
• Sign Up

 

This is the hidden content, please

• Sign In
• or
• Sign Up