Ukraine Hit with New Golang-based 'SwiftSlicer' Wiper Malware in Latest Cyber Attack

silversurfer · Jan 28, 2023

Ukraine has come under a fresh cyber onslaught from Russia that involved the deployment of a previously undocumented Golang-based data wiper dubbed SwiftSlicer.

ESET attributed the attack to Sandworm, a nation-state group linked to Military Unit 74455 of the Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).

"Once executed it deletes shadow copies, recursively overwrites files located in %CSIDL_SYSTEM%\drivers, %CSIDL_SYSTEM_DRIVE%\Windows\NTDS and other non-system drives and then reboots computer," ESET disclosed in a series of tweets.

The overwrites are achieved by using randomly generated byte sequences to fill 4,096 byte-length blocks. The intrusion was discovered on January 25, 2023, the Slovak cybersecurity company added.

Ukraine Hit with New Golang-based 'SwiftSlicer' Wiper Malware in Latest Cyber Attack

Ukraine is under attack from a new Golang-based data wiper called SwiftSlicer.

thehackernews.com

SwiftSlicer: New destructive wiper malware strikes Ukraine | WeLiveSecurity

ESET researchers have uncovered a new destructive data wiper, SwiftSlicer, being used by the Sandworm APT group in Ukraine.

www.welivesecurity.com

military · Jan 28, 2023

VirusTotal

www.virustotal.com

Judging by the hash sums, this is this file.

vtqhtr413 · Jan 28, 2023

Threat actors loyal to the Kremlin have stepped up attacks in support of its invasion of Ukraine, with denial-of-service attacks hitting German banks and other organizations and the unleashing of a new destructive data wiper on Ukraine.
Germany's BSI agency, which monitors cybersecurity in that country, said the attacks caused small outages but ultimately did little damage.
“Currently, some websites are not accessible,” the BSI said in a statement to news agencies. “There are currently no indications of direct effects on the respective service and, according to the BSI's assessment, these are not to be expected if the usual protective measures are taken.”