Ukraine: Recent Cyber Attacks Part of Wider Plot to Sabotage Critical Infrastructure

The coordinated cyberattacks targeting Ukrainian government websites^[1] and the deployment of a
data-wiper malware called WhisperGate^[2]
on select government systems are part of a broader wave of
malicious activities aimed at sabotaging critical
infrastructure^[3]
in the country.

The Secret Service of Ukraine on Monday confirmed that the two
incidents are related, adding the breaches also exploited the
recently disclosed Log4j vulnerabilities^[4]
to gain access to some of the compromised systems.

“The attack used vulnerabilities in the site’s content
management systems (October CMS) and Log4j, as well as compromised
accounts of employees of the development company,” the SSU said^[5], corroborating prior
disclosure from the Ukraine CERT team^[6].

“The attackers corrupted MBR records (the service information on
the media required to access the data) on individual servers and
user computers. Moreover, this applies to both operating systems
running Windows and Linux.”

The Ukrainian Cyber Police, for its part, noted^[7]
that it’s investigating a combination of three intrusion vectors
that were likely used to pull off the attacks — supply chain attack
targeting an IT firm which manages websites for the Ukrainian
government, exploitation of the flaw in October CMS, and Log4j
vulnerabilities.

What’s more, the IT firm referenced by Microsoft, Kitsoft,
confirmed on Facebook it had been hit with the WhisperGate malware.
“The current situation is not just about hacking websites, it is an
attack aimed at sowing panic and fear, destabilizing the country
from within,” the company said^[8].

While neither the Cyber Police nor the SSU attributed the
defacements and the destructive malware attacks to any threat group
or state-sponsored actor, the Ukrainian Ministry of Digital
Transformation pointed fingers at Russia, accusing^[9]
the country of trying to “wage a hybrid war.”