Russian courts and mayor offices being hit by a wiper malware attack

[thewayne]

It's an interesting attack. Once infected, the malware sits there. It contacts a control server and asks permission to attack. When permission is granted, it goes into the Windows Registry and makes changes to prevent Remote Desktop from contacting the computer, so remote administrators can't get into the PC and try to stop the attack. Pretty clever move, that. Then it stops database services so that databases are available. Normally database services lock their databases so those files can't be wiped, stopping the services make them vulnerable.

THEN the wiper launches! It poses as a ransomware attack, launching a pseudo-random number generator, overwriting the files with gibberish and giving them a .cry extension, thus it is now known as the Cry Wiper. The random gibberish makes it look like the file is encrypted, but analysis of the code reveals that it's a random number generator, meaning that even if you pay the demanded 0.5 Bitcoin ransom, you're never getting anything back.

It's common in ransomware attacks to change the extension of the file so people can recognize that they've been compromised and the files are no longer what they were.

Another clever thing about this is that it automatically excludes program and system files: com, exe, dll, etc., so the computer will continue to run perfectly normally, but no data will survive. The articles that I've read don't mention if this will crawl across network shares or seek elevated access privileges, but they weren't very deep articles.

A similar program struck Ukraine earlier this year, probably launched by Russian hacker group(s).

No attribution to this attack has been found. Since no ransomware can be collected, even though a Bitcoin digital wallet is provided, that's probably a dead trail.

https://arstechnica.com/information-technology/2022/12/never-before-seen-malware-is-nuking-data-in-russias-courts-and-mayors-offices/

https://it.slashdot.org/story/22/12/03/0044234/new-crywiper-data-wiper-targets-russian-courts-mayors-offices

Comments

[dewline]

There is a certain symmetry here...

[thewayne]

*Hands Russian criminals gangs and gov't a petard and hoist*

[disneydream06]

So, is Russia attacking Russia, or is somebody from outside Russia giving them a taste of their own medicine? lol.........
Hugs, Jon

[thewayne]

I think it's unlikely that it's Russia on Russia, though there are certainly dissidents inside Russian borders. Now, a lot of young Russians have fled to Turkey and elsewhere, so it is possible that it is Russians on Russia, but not the Putin gov't doing this.

[disneydream06]

Well, what goes around comes around. lol...

[silveradept]

It certainly seems like the kind of attacks that's meant to target something where losing access to the databases is the incapacitating factor. That seems restrained for many of the entities that we have been talking about with regard to cyberwarfare.

[thewayne]

Courts, government, and most everybody these days rely on databases in one form or another.  While they have a different meaning in the library community - which drives me nuts! - we still rely on them in our environment.

[silveradept]

Of course. That the wiper only targets the databases and nothing else is what I was thinking of as restraint - most non-state across that I know of would want to be louder and brasher in their work and taking credit for the work, and they would probably prefer to wreck the whole machine, not just the databases.

[thewayne]

Oh, it doesn't only target databases - it goes out of its way to shut down database services to target databases!  It specifically excludes anything related to OS or executable files to ensure that it wipes anything resembling to a data file.  It is not showing any restraint in the least.

Well ...

[ysabetwordsmith]

Cry me a river, bitches.

I agree that it is a clever and wicked virus, but I have no sympathy for Russia. Who lives by the hack, dies by the hack.

Re: Well ...

[thewayne]

No sympathy here, either.  The collective they have unleashed so much computer violence upon the world with the passive, if not active, permission of Putin that they certainly deserve what they are getting now.