A vital infrastructure entity inside Ukraine was focused by a beforehand unseen information wiper malware named PathWiper, in accordance with new findings from Cisco Talos.
“The assault was instrumented through a professional endpoint administration framework, indicating that the attackers doubtless had entry to the executive console, that was then used to subject malicious instructions and deploy PathWiper throughout linked endpoints,” researchers Jacob Finn, Dmytro Korzhevin, and Asheer Malhotra stated in an evaluation revealed Thursday.
The assault is assessed to be the work of a Russia-nexus superior persistent menace (APT) actor based mostly on the tradecraft noticed and the overlapping capabilities with harmful malware utilized in assaults in opposition to Ukraine.
Talos stated the instructions issued by the executive software’s console had been acquired by its shopper operating on the sufferer endpoints after which executed as a batch (BAT) file.
The BAT file, in flip, consisted of a command to run a malicious Visible Primary Script (VBScript) file within the Home windows TEMP folder known as “uacinstall.vbs,” that was additionally pushed to the machines through the executive console. The VBScript, for its half, dropped the wiper binary beneath the identify “sha256sum.exe” in the identical folder and executed it.
“All through the course of the assault, filenames and actions used had been supposed to imitate these deployed by the executive utility’s console, indicating that the attackers had prior information of the console and probably its performance throughout the sufferer enterprise’s surroundings,” Talos stated.
As soon as launched, PathWiper is designed to collect a listing of linked storage media, together with bodily drive names, quantity names and paths, and community drive paths. The wiper then proceeds to create one thread per drive and quantity for each path recorded and overwrites the contents of the artifacts with randomly generated bytes.
Particularly, it targets: Grasp Boot Document (MBR), $MFT, $MFTMirr, $LogFile, $Boot, $Bitmap, $TxfLog, $Tops, and $AttrDef. As well as, PathWiper irrevocably destroys recordsdata on disk by overwriting them with randomized bytes and makes an attempt to dismount volumes.
PathWiper has been discovered to share some stage of similarity with HermeticWiper (aka FoxBlade, KillDisk, or NEARMISS), which was detected coinciding with Russia’s full-scale army invasion of Ukraine in February 2024. The HermeticWiper malware is attributed to the Russia-linked Sandworm group.
Whereas each wipers try and corrupt the MBR and NTFS-related artifacts, it bears noting that HermeticWiper and PathWiper differ within the method the info corruption mechanism is used in opposition to recognized drives and volumes.
“The continued evolution of wiper malware variants highlights the continued menace to Ukrainian vital infrastructure regardless of the longevity of the Russia-Ukraine battle,” the researchers stated.
Silent Werewolf Targets Russia and Moldova
The invention of a brand new breed of wiper malware in opposition to Ukraine comes as Russian cybersecurity firm BI.ZONE uncovered two new campaigns undertaken by Silent Werewolf in March 2025 to contaminate Moldovan and Russian corporations with malware.
“The attackers employed two separate loader situations to retrieve the malicious payload from their C2 server,” the corporate stated. “Sadly, the payload itself was not obtainable on the time of this analysis. Nevertheless, a retrospective evaluation of comparable Silent Werewolf campaigns means that the menace actor used XDigo malware.”
A few of the targets of the assaults embody nuclear, plane, instrumentation, and mechanical engineering sectors in Russia. The place to begin is a phishing electronic mail containing a ZIP file attachment that, in flip, consists of an LNK file and a nested ZIP archive. The second ZIP file consists of a professional binary, a malicious DLL, and a decoy PDF.
Unpacking and launching the Home windows shortcut file triggers the extraction of the nested archive and finally causes the rogue DLL to be sideloaded through the professional executable (“DeviceMetadataWizard.exe”). The DLL is a C# loader (“d3d9.dll”) that is designed to retrieve the next-stage payload from a distant server and show the lure doc to the sufferer.
“The adversaries seem to run checks on the right track techniques,” BI.ZONE stated. “If a goal host doesn’t meet sure standards, the Llama 2 massive language mannequin (LLM) in GGUF format is downloaded from hxxps://huggingface[.]co/TheBloke/Llama-2-70B-GGUF/resolve/most important/llama-2-70b.Q5_K_M.gguf.”
“This hinders the great evaluation of your entire assault and permits the menace actor to bypass defenses equivalent to sandboxes.”
The cybersecurity agency stated it noticed a second marketing campaign that very same month focusing on unknown sectors in Moldova and, doubtless, Russia utilizing the identical C# loader, however through phishing lures associated to official trip schedules and proposals for shielding company data infrastructure in opposition to ransomware assaults.
The cyber espionage group, per BI.ZONE, is believed to be lively at the very least since 2011, focusing on a variety of corporations in Russia, Belarus, Ukraine, Moldova and Serbia. The assaults are characterised by means of phishing lures to ship malware equivalent to XDSpy, XDigo, and DSDownloader.
Professional-Ukrainian Hacktivist Group BO Workforce Targets Russia
In current months, Russian state-owned corporations and organizations spanning expertise, telecommunications, and manufacturing verticals are additionally stated to have come beneath cyber assaults from a pro-Ukrainian hacktivist group codenamed BO Workforce (aka Black Owl, Hoody Hyena, and Lifting Zmiy).
“BO Workforce is a severe menace aimed each at inflicting most injury to the sufferer and at extracting monetary advantages,” Kaspersky researchers stated in a report final week, detailing the menace actor’s means to sabotage sufferer’s infrastructure and, in some situations, even resorts to information encryption and extortion.
Energetic since at the very least January 2024, assaults mounted by the hacktivist cluster are recognized to leverage post-exploitation frameworks, together with Mythic and Cobalt Strike, in addition to professional distant entry and tunneling instruments. The group additionally has a historical past of accessing confidential information and publishing details about profitable assaults in its Telegram channel BO Workforce.
Preliminary entry to focus on networks is completed by sending phishing emails containing booby-trapped attachments that, when opened, activate an an infection chain designed to deploy recognized commodity malware households like DarkGate, BrockenDoor, and Remcos RAT. Additionally used are instruments equivalent to HandleKatz and NanoDump for dumping LSASS and creating LSASS dumps, respectively.
Armed with the distant entry, BO Workforce has been noticed destroying file backups, deleting recordsdata utilizing the SDelete utility, and moreover dropping the Home windows model of the Babuk encryptor to demand a ransom in alternate for regaining entry.
A few of the different actions carried out by the menace actor are listed beneath –
- Establishing persistence utilizing scheduled duties
- Assigning malicious part names much like system or well-known executable recordsdata to evade detection
- Extracting the Energetic Listing database utilizing ntdsutil
- Working varied instructions to gather details about Telegram, operating processes, present customers, distant RDP classes, and antivirus software program put in on the endpoints
- Utilizing RDP and SSH protocols to carry out lateral motion inside Home windows and Linux infrastructures
- Dropping professional distant entry software program like AnyDesk for command-and-control
“The BO Workforce group poses a major menace to Russian organizations as a result of its unconventional method to conducting assaults,” Kaspersky stated. “In contrast to most pro-Ukrainian hacktivist teams, BO Workforce actively makes use of a large arsenal of malware, together with backdoors equivalent to BrockenDoor, Remcos, and DarkGate.”
“These options verify the excessive stage of autonomy of the group and the absence of secure connections with different representatives of the pro-Ukrainian hacktivist cluster. Within the public exercise of BO Workforce, there are virtually no indicators of interplay, coordination or alternate of instruments with different teams. This as soon as once more emphasizes its distinctive profile throughout the present hacktivist panorama in Russia.”
