Ukraine Hit with New Golang-based 'SwiftSlicer' Wiper Malware in Latest Cyber Attack

[silversurfer]

Content source

https://thehackernews.com/2023/01/ukraine-hit-with-new-golang-based.html

Ukraine has come under a fresh cyber onslaught from Russia that involved the deployment of a previously undocumented Golang-based data wiper dubbed SwiftSlicer.

ESET attributed the attack to Sandworm, a nation-state group linked to Military Unit 74455 of the Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).

"Once executed it deletes shadow copies, recursively overwrites files located in %CSIDL_SYSTEM%\drivers, %CSIDL_SYSTEM_DRIVE%\Windows\NTDS and other non-system drives and then reboots computer," ESET disclosed in a series of tweets.

The overwrites are achieved by using randomly generated byte sequences to fill 4,096 byte-length blocks. The intrusion was discovered on January 25, 2023, the Slovak cybersecurity company added.

Ukraine Hit with New Golang-based 'SwiftSlicer' Wiper Malware in Latest Cyber Attack

Ukraine is under attack from a new Golang-based data wiper called SwiftSlicer.

thehackernews.com

SwiftSlicer: New destructive wiper malware strikes Ukraine | WeLiveSecurity

ESET researchers have uncovered a new destructive data wiper, SwiftSlicer, being used by the Sandworm APT group in Ukraine.

www.welivesecurity.com

 

[military]

VirusTotal

VirusTotal

www.virustotal.com

Judging by the hash sums, this is this file.

 

[vtqhtr413]

Threat actors loyal to the Kremlin have stepped up attacks in support of its invasion of Ukraine, with denial-of-service attacks hitting German banks and other organizations and the unleashing of a new destructive data wiper on Ukraine.
Germany's BSI agency, which monitors cybersecurity in that country, said the attacks caused small outages but ultimately did little damage.
“Currently, some websites are not accessible,” the BSI said in a statement to news agencies. “There are currently no indications of direct effects on the respective service and, according to the BSI's assessment, these are not to be expected if the usual protective measures are taken.”

#GermanyRIP. Kremlin-loyal hacktivists wage DDoSes to retaliate for tank aid

Killnet hacktivist group appears to have indirect ties to the Russian government.

arstechnica.com