In recent weeks, Ukraine has been hit with numerous cyberattacks targeting its government and banking sector as a part of the Russo-Ukrainian crisis. Several Ukrainian government departments and banks were knocked offline by a DDoS attack, and multiple wiper malwares have been observed targeting Ukrainian organizations.

For its part, Russia claimed it has never conducted and does not conduct any malicious operations in cyberspace.

These attacks resulted in fear of a wider cyber conflict, with western governments bracing for Russian cyberthreats and considering their response.

The Russia-Ukraine Cyber Conflict

In January, about 70 government websites were taken offline by a DDoS attack. Shortly after, a destructive malware infected government, non-profit, and IT organization devices in Ukraine. This malware, dubbed WhisperGate, was designed to look like ransomware, but lacks a recovery feature, indicating that their goal was to destroy files rather than to encrypt them for ransom.

Hours prior to the beginning of the Russian invasion of Ukraine, a new wiper malware was discovered. This attack leveraged at least three components: HermeticWiper for data wiping, HermeticWizard for spreading in the network, and HermeticRansom acting as a decoy ransomware. HermeticWiper was seen conducting malicious activity as early as November 2021, indicating that the attack was prepared months in advance. 

As the invasion began, the second wiper malware, IsaacWiper, surfaced. IsaacWiper and HermeticWiper have no code similarities, the former is less sophisticated than the latter.

While it cannot be confirmed whether Russia is behind these attacks, it is believed they are part of Russia’s “hybrid warfare”, which consists of a combination of conventional and advanced methods.

Ukraine’s cyber activity has not been solely defensive, with the Ukrainian government forming an “IT Army”. Since the crisis began, several Russian government and media websites have been intermittently offline. Some of these attacks were carried out by the Anonymous hacktivist movement, which has pledged allegiance to Ukraine. The group and its affiliates also claimed to have compromised the Russian Nuclear Institute and the Control Center of the Russian Space Agency ‘Roscosmos’.

Russian APT Groups and Known Attacks

There are a number of APT groups affiliated with Russian organizations:

APT28

• Attribution: Russia’s General Staff Main Intelligence Directorate (GRU)
• Active since: 2004
• Targets: The defense and energy sectors and government organizations
• Associated attacks: The Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016
• Tools used: Koadic, Mimikatz, Net, Responder, Tor, USBStealer, Zebrocy

APT29

• Attribution: Russia’s Foreign Intelligence Service (SVR)
• Active since: 2008
• Targets: Government networks in Europe and NATO member countries, research institutes, and think tanks
• Associated attacks: The SolarWinds supply chain compromise cyber operation was attributed to the SVR, public statements included citations to APT29
• Tools used: Mimikatz, Net, Cobalt Strike, PsExec, CosmicDuke, FatDuke, GeminiDuke, PowerDuke, SeaDuke, SUNBURST

Sandworm Team

• Attribution: Russia’s General Staff Main Intelligence Directorate (GRU)
• Active since: 2009
• Targets: Ukrainian electrical companies and government organizations, Georgia
• Associated attacks: The 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the NotPetya attack, the 2018 Olympic Destroyer attack, and attacks against Georgia in 2018 and 2019
• Tools used: Mimikatz, Net, PsExec, BlackEnergy, Industroyer, NotPetya, KillDesk

Wizard Spider

• Attribution: Russia-based financially motivated threat group
• Active since: 2016
• Targets: The group has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals
• Associated attacks: The group is originally known for the creation and deployment of TrickBot
• Tools used: Mimikatz, Net, Cobalt Strike, PsExec, Empire, Bazar, Conti, Dyre, Emotet, GrimAgent, Ryuk, TrickBot

Dragonfly 2.0

• Attribution: A suspected Russian threat group
• Active since: 2015
• Targets: Government entities and multiple U.S. critical infrastructure sectors and parts of the energy sector within Turkey and Switzerland
• Associated attacks: 
• Tools used: Net, PsExec, Reg, CrackMapExec, Impacket

Additional Russian APT groups include ALLANITE, Indrik Spider, Nomadic Octopus, TEMP.Veles, and Turla.

Tools and Vulnerabilities

These APT groups use various tools and malwares in their attacks, ranging from commercial, open-source software, to custom software designed for malicious purposes.

Tools:

1. Mimikatz – Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.
2. Net – The Net utility is a component of the Windows operating system, which can be useful for an adversary, such as gathering system and network information for discovery, moving laterally through SMB/Windows admin shares, and interacting with services.
3. Cobalt Strike – Cobalt Strike is an adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors.
4. PsExec – PsExec is a tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.
5. Empire – Empire is a post-exploitation tool which was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.

ICS Malwares:

1. BlackEnergy – BlackEnergy is a malware toolkit that was originally designed to create botnets for use in conducting DDoS attacks. It is well known for being used during the confrontation between Georgia and Russia in 2008, as well as in targeting Ukrainian institutions.
2. Industroyer – Industroyer is a sophisticated malware framework designed to impact the working processes of industrial control systems (ICS), specifically components used in electrical substations. It was used in the attacks on the Ukrainian power grid in December 2016.
   
   

Additional Malwares and Ransomwares:

1. NotPetya – While NotPetya appears as a form of ransomware, its main purpose was to destroy data and disk structures on compromised systems. It contains worm-like features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.
2. Bazar – Bazar is a downloader and backdoor with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe.
3. Conti – Conti is a ransomware-as-a-service that has been used against major corporations and government agencies, particularly those in North America.
4. Emotet – Emotet is a modular malware variant used as a downloader for other malwares such as TrickBot. It has been primarily used to target the banking sector.
5. Ryuk – Ryuk is a ransomware designed to target enterprise environments.
6. TrickBot – TrickBot is a Trojan spyware program used for targeting banking sites in North America, Australia, and throughout Europe; it has since been used against all sectors worldwide as part of “big game hunting” ransomware campaigns.
   
   

How SCADAfence Helps Industrial Organizations

We provide a comprehensive solution – The SCADAfence platform which was built to protect industrial organizations like yours from industrial cyber attacks (including ransomware). It also helps you implement better security practices amongst its built-in features. Some of these include:

• Asset Management 
• Network Maps
• Traffic Analyzers

The platform, which is also the highest-rated OT & IoT security platform, also monitors the network traffic for any threats, including ones that are found in typical ransomware attacks; such as:

• Security exploits being sent across the network.
• Lateral movement attempts using the latest techniques.
• Network scanning and network reconnaissance.
  
  

SCADAfence’s security research team is constantly tracking events and incidents, analyzing them, and implementing different ways to detect those events.

• The SCADAfence Platform detects the use of WMI and SMB, used by HermeticWizard for spreading across the network.
• The Platform also detects various tools and vulnerabilities used by Russian APTs, attacks and malware such as: EternalBlue & EternalRomance, BlueKeep, Metasploit, Cobalt-Strike, Remote Services, Remote Scheduled Tasks, OS Credential Dumping (Mimikatz), BITSAdmin and SMB brute-force.
• The Platform provides an up to date reputation service to track malicious files, IPs and domains associated with Russian APTs and malware.

Recommendations & Best Practices

SCADAfence team recommends following the best practices:

• Make sure secure offline backups of critical systems are available and up-to-date.
• Apply the latest security patches on the assets in the network.
• Use unique passwords and multi-factor authentication on authentication paths to OT assets.
• Enable strong spam filters to prevent phishing emails from reaching end users.
• Disable ports and protocols that are not essential.
• Encrypt sensitive data when possible.
• Educate staff about the risks and methods of ransomware attacks and how to avoid infection.
• Recommendation for HermeticWizard: Monitor traffic on the ports HermeticWizard uses to worm through networks – ports 20, 21, 80, 135, 137, 139, 443, and 445.
• Recommendation for HermeticRansom: Consider using the Go script in the following link for decryption purposes.