Ukraine Hit with New Golang-based ‘SwiftSlicer’ Wiper Malware in Latest Cyber Attack

Jan 28, 2023Ravie LakshmananCyber Threat / Cyber War

Ukraine has come under a fresh cyber onslaught from Russia that
involved the deployment of a previously undocumented Golang-based
data wiper dubbed SwiftSlicer.

ESET attributed the attack to Sandworm, a nation-state group
linked to Military Unit 74455 of the Main Intelligence Directorate
of the General Staff of the Armed Forces of the Russian Federation
(GRU).

“Once executed it deletes shadow copies, recursively overwrites
files located in %CSIDL_SYSTEM%\drivers,
%CSIDL_SYSTEM_DRIVE%\Windows\NTDS and other non-system drives and
then reboots computer,” ESET disclosed^[1]
in a series of tweets.

The overwrites are achieved by using randomly generated byte
sequences to fill 4,096 byte-length blocks. The intrusion was
discovered on January 25, 2023, the Slovak cybersecurity company
added.

Sandworm, also tracked under the monikers BlackEnergy, Electrum,
Iridium, Iron Viking, TeleBots, and Voodoo Bear, has a history of
staging disruptive and destructive cyber
campaigns^[2] targeting organizations
worldwide since at least 2007.

The sophistication of the threat actor is evidenced by its
multiple distinct kill chains, which comprise a wide variety of
custom tools such as BlackEnergy, GreyEnergy, Industroyer,
NotPetya, Exaramel^[3], and Cyclops Blink^[4].

In 2022 alone, coinciding with Russia’s military invasion of
Ukraine, Sandworm has unleashed WhisperGate^[5], HermeticWiper^[6], IsaacWiper^[7], CaddyWiper^[8], Industroyer2^[9], Prestige^[10], and RansomBoggs^[11] against critical
infrastructure in Ukraine.

“When you think about it, the growth in wiper malware during a
conflict is hardly a surprise,” Fortinet FortiGuard Labs researcher
Geri Revay said^[12] in a report published
this week. “It can scarcely be monetized. The only viable use case
is destruction, sabotage, and cyberwar.”

The discovery of SwiftSlicer points to the consistent use of
wiper malware variants by the Russian adversarial collective in
attacks designed to wreak havoc in Ukraine.

The development also comes as the Computer Emergency Response
Team of Ukraine (CERT-UA) linked Sandworm to a recent largely
unsuccessful cyberattack on the national news agency Ukrinform.

The intrusion, which is suspected of having been carried out no
later than December 7, 2022, entailed the use of five different
pieces of data wiping programs, namely CaddyWiper, ZeroWipe,
SDelete^[13], AwfulShred^[14], and BidSwipe targeting
Windows, Linux, and FreeBSD systems.

“It was established that the final stage of the cyberattack was
initiated on January 17, 2023,” CERT-UA said^[15] in an advisory.
“However, it had only partial success, in particular, in relation
to several data storage systems.”

Sandworm is not the only group that has its eyes on Ukraine^[16]. Other Russian
state-sponsored actors such as APT29^[17], COLDRIVER^[18], and Gamaredon^[19]have actively targeted a
range of Ukrainian organizations since the onset of the war.