In further attacks on the Ukrainian energy industry, ESET was able to identify a new variant of the Industroyer malware: Industroyer 2. ESET researchers suspect the APT group Sandworm to be behind the latest attacks with a high level of certainty.
Substations in Ukraine are under attack. The aim of the hackers is to shut down the infrastructure. ESET researchers have worked closely with the Ukrainian CERTto protect the company's network. Here, a new variant of the Industroyer malware was discovered, which the experts are now calling Industroyer2. Industroyer is a notorious malware that was used by APT group Sandworm back in 2016 to disrupt electricity supply in Ukraine.
“Ukraine is once again at the center of cyberattacks on its critical infrastructure. This new Industroyer campaign follows several waves of wipers targeting different sectors in Ukraine,” explains Thorsten Urbanski, Security Expert at ESET. "We will continue to monitor the threat landscape to protect organizations from these types of destructive attacks."
Arsenal of various malicious programs are used
In addition to Industroyer2, the Sandworm group used several destructive malware families including HermeticWiper, CaddyWiper, ORCSHRED, SOLOSHRED, and AWFULSHRED. CaddyWiper first came into use in mid-March when it was used against a Ukrainian bank. A variant of CaddyWiper was used on April 8 against the aforementioned Ukrainian energy company.
Who is Sandworm?
The security researchers at iSIGHT Partners, who discovered references to Frank Herbert's novel Dune in the binaries of the BlackEnergy malware in 2014, chose the name "Sandworm". At the time, ESET researchers presented their findings on multiple targeted BlackEnergy attacks in Ukraine and Poland at a Virus Bulletin conference.
There was some speculation that Sandworm was a group operating out of Russia. But it wasn't until 2020 that the U.S. Department of Justice specifically identified Sandworm as Russian Military Intelligence's General Intelligence Directorate (GRU) military unit 74455. This is to reside in a building in the Moscow district of Chimki, which is colloquially called "the tower".
More at ESET.com
About ESET ESET is a European company with headquarters in Bratislava (Slovakia). ESET has been developing award-winning security software since 1987 that has already helped over 100 million users enjoy secure technology. The broad portfolio of security products covers all common platforms and offers companies and consumers worldwide the perfect balance between performance and proactive protection. The company has a global sales network in over 180 countries and branches in Jena, San Diego, Singapore and Buenos Aires. For more information, visit www.eset.de or follow us on LinkedIn, Facebook and Twitter.