Security Advisory – In cyber attacks against Ukraine, a new destructive malware has been used

Summary

The threat intelligence community has seen a new wiper malware sample known as “HermeticWiper” circulating in Ukrainian enterprises, and investigation suggests that a signed driver is being used to deliver a wiper that targets Windows devices, modifying the MBR and causing boot failure as a result.

Indicators of Compromise

Recommendations

1. Companies must keep their systems up to date.
2. Organizations SHOULD ALWAYS keep an eye on network traffic for malicious activity sent by threat actors.
3. Organizations must regularly raise awareness about social engineering instances and offer workshops and trainings on how to protect themselves from such attacks.
4. Using intrusion detection and prevention systems will assist keep the network in good shape.
5. Make use of advanced e-mail security software.
6. Make use of powerful end-point protection and detection solutions that include ransomware rollback capabilities.

Reference

https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/