About the webinar
On March 10, 2022 Kaspersky’s Global Research and Analysis Team (GReAT) shared their insights into the current (and past) cyberattacks in Ukraine. In this post we address the questions that we did not have the time to answer and provide the Indicators of Compromise (IoCs) that can help you defend against the identified threats. You can watch the full recording of the webinar here: ‘A look at current cyberattacks in Ukraine‘
The webinar included an historical overview of attacks on Ukraine; and an overview of current cyber-activity in the country, which comprises known APT activity, unknown parties carrying out DDoS attacks and leveraging commodity RATs, hacktivism, activities by cybercriminals and unattributed attacks.
In the webcast, we also provided an analysis of attacks identified using Kaspersky’s honeypot network in Ukraine; as well as an analysis of the APT attacks by Gamaredon, Cyclops Blink, Hades/Sandworm and unknown groups, using commodity malware such as PandoraBlade. We also looked into different wipers that have been used against organizations in Ukraine, including HermeticWiper, WhisperGate, IsaacWiper and HermeticRansom. We also covered unknown and unattributed attacks and hacktivist activity taking place in the same timeframe.
We assess that the number of cyber attacks in Ukraine will increase during the next six months. While most of the current attacks are of low complexity – such as DDoS or attacks using commodity and low-quality tools – more sophisticated attacks exist also, and more are expected to come. Current complex activities include the employment of HermeticWiper, which stands out due to its sophistication, as well as the Viasat ‘cyber event’ – the partial network outage that impacted internet service for fixed broadband customers in Ukraine and elsewhere on the European KA-SAT network that affected over 30,000 plus terminals in Europe.
Currently, we assess that the risk of the cyber component of this conflict spilling over to Europe is medium-high.
We advise organizations to:
- Take typical measures against DDoS attacks, ransomware and destructive malware, phishing, targeted attacks, supply-chain attacks and firmware attacks
- Make sure that any and all internet-facing systems are up-to-date with all the latest patches installed
- Install security software on endpoints
- Set up extensive logging that will allow defenders to be alerted about suspicious events
- Establish strict application white-listing on all machines
- Actively hunt for attackers inside the company’s internal network
- Integrate Threat Intelligence into SOC, EDR and leverage IOCs, YARA, Suricata and Sigma rules. We would also refer you to Kaspersky’s Threat Intelligence Resource Hub, which currently provides free access to independent, continuously updated and globally-sourced information on ongoing cyberattacks and threats.
Due to time limitations, we could not address all questions during the webinar, so here are our answers for the remaining questions we received in the live session:
Q: What are the chances that we’ll see attacks using enterprise resources to launch attacks?
A: Depending on the nature of the attack, actors may not differentiate between home, SMB and enterprise systems. For example, infected IoT and network devices such as IP-cameras may be used by anyone, and may be infected and abused by attackers to launch attacks such as DDoS attacks. Attackers will use and abuse any resources they require in order to conduct their attack. If this includes enterprise resources then they will be included in the attackers scope.
Q: Currently we have seen massive connection outbreaks in many different services over TOR-exits located in the German region. Does this provide a “true” picture of the threat landscape, since many attackers seem to be from – in this instance – Germany but might originate from regions that are very interested in causing damage to Europe or Ukraine specifically right now?
A: We commonly take TOR and other anonymizing services into account when it comes to the origin of attacks. Not all attacks, for example on our honeypot infrastructure, are easily possible through TOR due to enforced policies on exit-nodes.
Q: I’m wondering what you can say about the attacks on Russian targets, both from “hacktivists” and others? Can you help us separate the hype and exaggerations from attacks that are having a real impact?
A: We have seen several public “hack” announcements. Most of them don’t include enough evidence to confirm a real hack; nor do we have the abilities or resources to verify most of them as they are very specific and “targeted”.
The most important suggestion is to not blindly trust all messages, reports and claims – especially unverified content or if it’s from unverified channels/accounts.
Q: We all know of REvil group activity and the Kaseya case. REvil members were arrested by the Russian FSB a few months ago. Do you believe that these people might be “employed” by the Kremlin to organize an attack against Ukraine? Or you think it might be possible to determine if any attackers are former REvil members?
A: We don’t have any insights into the employment of criminals or other threat actors; nor into plans and strategies of any government or related organizations. Our focus is on the technical aspects only, which is where our expertise and focus lies. The real world identity of criminals and other threat actors is the focus area of law enforcement and related agencies.
Q: How may this conflict between Russia and Ukraine affect financial operations? Are firewalls and antivirus tools enough to defend against a cyberattack that comes from Europe?
A: Financial transactions and other operations are handled through the networks of financial institutions. These are usually secured using many different methods. The origin (that is, region or country) is usually not the first question in regards to defense, but rather technical aspects and targets. Depending on that, particular methods and policies should be applied to protect against attacks.
Q: Do you have any current readings on attacks on NGOs?
A: Several investigations reveal that targets include NGOs – these are accessible through our Threat Intelligence Reporting Service.
Q: How can we use the Kaspersky honeypot and sandbox?
A: Our honeypots are not part of any Kaspersky products. They are dedicated systems where specific sensors are installed in order to monitor attacks. However, you may join our honeypot initiative (for details, email us at email@example.com).
You may access and use the Kaspersky Sandbox within our Product & Service offerings: Kaspersky Sandbox and Kaspersky Threat Intelligence. File analysis can also be conducted through OpenTIP.
What follows is the list of IoCs we derived from our honeypot-sensors in Ukraine. These are the observed, most prominent and relevant attacking IP addresses.
Indicators of Compromise (IoCs)
IPs found attacking Ukraine honeypot assets
033fa3ae260e465da3d541bc138d2e1d WhiteBlackCrypt x32
4a6bec571521881b387b9de3d7b06aa0 WhiteBlackCrypt x32
072da4148add1d8ee1e691cb94b31737 WhiteBlackCrypt x32
99bd77ae4a287904c813960727046d80 WhiteBlackCrypt x32
b36e5c508efea796731d444c189b413c WhiteBlackCrypt x64
490d8cdaf68619f23a2e03f55fd9e33e Pandora hVNC
6942546805623a1648960ffdc91d1cff Pandora hVNC
c2cbd5caa9012e4878ff35c31cb2122f Pandora hVNC
02190c8c52bfafe4fa69b2972f867c1b Pandora hVNC
e34d6387d3ab063b0d926ac1fca8c4c4 MicroBackdoor spearphishing ZIP archive
2556a9e1d5e9874171f51620e5c5e09a MicroBackdoor CHM dropper
bc6932a0479045b2e60896567a37a36c MicroBackdoor JS dropper
More IOCs are available to customers of the Kaspersky Intelligence reporting service. Contact: firstname.lastname@example.org