Ukraine conflict

The German Federal Office for Information Security (BSI) warned users to avoid using Kaspersky software and instead consider alternatives.

The BSI agency cautioned that the ‘Russian IT manufacturer can carry out offensive operations itself, be forced to attack target systems against its will, or be spied on without its knowledge as a victim of a cyber operation, or be misused as a tool for attacks against its own customers.’

The agency added that trust in the reliability and self-protection of a manufacturer as well as its authentic ability to act is crucial for the safe use of such systems. If there are doubts about the reliability of the manufacturer, virus protection software poses a particular risk for the IT infrastructure.

In response, Kaspersky stated that it is a ‘private global cybersecurity company’ with no ties to the Russian government. Kaspersky added that the BSI’s warning was politically motivated and that it was in contact with the BSI to clarify the issue.

Ukraine’s Computer Emergency Response Team (CERT-UA) warned that threat actors are using fake Windows antivirus updates to install Cobalt Strike and other malware in Ukraine. The phishing emails, which impersonate Ukrainian government agencies, propose a way to increase network security and advise recipients to download the BitdefenderWindowsUpdatePackage.exe., falsely dubbed a ‘critical security update’. 

When executed, the malware downloads and installs a Cobalt Strike beacon. The malware also downloads a Go downloader (dropper.exe), which then decodes and executes a secondary file (java-sdk.exe). This secondary file modifies the registry of the infected system to establish persistence and downloads two additional payloads, the GraphSteel backdoor (microsoft-cortana.exe) and the GrimPlant backdoor (oracle-java.exe).

CERT-UA associates the malicious activity with the UAC-0056 group, also known as ‘Lorec53’, a sophisticated Russian-speaking threat group, with medium confidence.

Experts at ESET Research Labs discovered a new data wiper, named CaddyWiper, that was used in cyberattacks targeting Ukrainian organisations. According to the experts, the new wiper malware affects users by erasing user data and partition information from any drives attached to a machine that has been compromised. CaddyWiper, unlike previous viruses used against Ukraine, does not share any significant code similarity with HermeticWiper, IsaacWiper or any other known malware.

CaddyWiper avoids destroying data on domain controllers. Experts at ESET Research Labs concluded that it was ‘likely a way for the attackers to keep their access inside the organisation while still disturbing operations’.