Russia unleashed data-wiper virus on Ukraine

Cyber experts have identified a new strain of computer-disabling malware unleashed on Ukrainian targets as part of Russia’s offensive, as the UK government and banks said they were on alert for online attacks.

Russia was widely expected to launch a cyber assault alongside its military campaign, and the run-up to the invasion of Ukraine was marked by the deployment of a “wiper” virus. A distributed denial-of-service (DDoS) attack, which paralyses websites by bombarding them with spurious information requests, also hit Ukrainian government sites.

On Wednesday, ESET Research Labs, a Slovakia-based cybersecurity company, said it had detected a new piece of data-wiping malware on hundreds of machines in Ukraine.

ESET said large organisations had been affected, while security experts at Symantec’s threat intelligence team said the malware had affected Ukrainian government contractors in Latvia and Lithuania and a financial institution in Ukraine. ESET has called the malware, which renders computers inoperable by disabling rebooting, HermeticWiper.

The NotPetya attack of 2017, which devastated Ukrainian businesses, was a wiper attack that encrypted computers irretrievably and spilled over into other countries, causing $10bn (£7.5bn) of damage worldwide.

Alexi Drew, a senior analyst at RAND Europe, a research institute, said cyber offensives carried the risk of escalating rapidly. “There’s a history of cyber-attacks not staying where they’re meant to go. If you look at NotPetya, the splash damage there was significant. There is a danger here of escalation because offensive cyber activity is fundamentally not very good at staying where you put it.”

Priti Patel said officials were on alert for cyber-attacks and disinformation campaigns from Moscow. “As we monitor developments, we will be especially mindful of the potential for cyber-attacks and disinformation emanating from Russia,” the home secretary said.

The chief executive of Lloyds Bank, Charlie Nunn, said on Thursday the lender was on “heightened alert … internally around our cyber risk controls, and we’ve been focused on this for quite a while”. Preparation for potential cyber-attacks was discussed in a meeting between the government and banking industry leaders on Wednesday, Nunn added.

According to Symantec, the wiper attack that hit Ukraine this week had been planned for some time. One Ukrainian organisation suffered an initial hack in December last year that was related to the recent attack.

DDoS attacks were also deployed ahead of the military offensive in order to spread confusion, according to the US cybersecurity firm Mandiant. In a DDoS attack, websites are deluged with vexatious requests for information and become unreachable. The targets on Wednesday included the Ukrainian defence ministry and PrivatBank, Ukraine’s largest commercial bank.

“It’s not so much the technical disruption, it’s what it does to undermine confidence, like in the financial sector. It gets people quite nervous. It’s more that kind of secondary impact,” said Jamie Collier, a Mandiant consultant, who described a DDoS as akin to stuffing a thousand envelopes through a letterbox every second.

However, Dr Lennart Maschmeyer at the Center for Security Studies at the Swiss university ETH Zurich, said Russia’s cyber strategy so far seemed more improvised. “A plausible scenario for more devastating cyber-attacks was that Russia had planned this invasion for a long time, and prepositioned implants across Ukraine’s critical infrastructure in order to cause mass disruptions coinciding with the military invasion. That does not seem to be the case. The cyber operations we have seen do not show long preparation, and instead look rather haphazard,” he said.