Push Admin

Ukraine computers hit by data-wiping software as Russia launched invasion

Article (news)

Reuters

<div class="embed-wrap"><figure data-feedback="fb:likes,fb:comments"><img alt="Earlier on Wednesday the websites of Ukraine" s="" foreign="" ministry="" and="" state="" security="" service="" were="" down="" in="" what="" the="" government="" said="" was="" another="" denial="" of="" attack.="" Dado="" Reuters="" src="https://sa.kapamilya.com/absnews/abscbnnews/media/2022/overseas/02/25/02252022-ukraine-crisis-cyber.jpg"/><figcaption>Earlier on Wednesday the websites of Ukraine&#x27;s government, foreign ministry and state security service were down in what the government said was another denial of service attack. <em>Dado Ruvic, Reuters illustration</em></figcaption></figure></div><p>LONDON/KYIV—A newly discovered piece of destructive software found circulating in Ukraine has hit hundreds of computers, according to researchers at the cybersecurity firm ESET, part of what Ukrainian officials said was an intensifying wave of hacks aimed at the country.</p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/overseas/02/25/22/fighting-rages-around-ukraine-as-russia-invades">Fighting rages around Ukraine, as Russia invades from three sides</a></li></ul><p>The company said on Twitter that the data wiping program had been installed on hundreds of machines in the country, an attack it said had likely been in the works for the past couple of months.</p><p>Vikram Thakur of cybersecurity firm Symantec, which is also looking into the incident, told Reuters that infections had spread outside Ukraine.</p><p>&quot;We see activity across Ukraine and Latvia,&quot; Thakur said. A Symantec spokesperson later added Lithuania.</p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/overseas/02/25/22/china-rejects-calling-russia-move-invasion">China rejects calling Russia move ‘invasion’, urges citizens in Ukraine to stay home</a></li></ul><p>Who is responsible for the wiper is unclear, although suspicion immediately fell on Russia, which has repeatedly been accused of launching data-scrambling hacks against Ukraine and other countries. Russia has denied the allegations.</p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/overseas/02/25/22/un-red-cross-call-for-protecting-civilians-in-ukraine">UN, Red Cross call for protecting civilians, vital structures in Ukraine</a></li></ul><p>The victims in Ukraine included a government agency and a financial institution, according to 3 people who studied the malware since its release.</p><p>The new cyberattack required existing access to function, meaning those computer networks were already compromised, said Juan-Andres Guerrero-Saade, a cybersecurity researcher at digital security firm SentinelOne.</p><p>&quot;In order to push this, they would have already needed domain admin. They basically owned the entire enterprise. The entire network. So, they didn&#x27;t have to do this. This was meant to damage, disable, signal and cause havoc,&quot; said Guerrero-Saade.</p><p>Researchers found that the wiping software appeared to have been digitally signed with a certificate issued to an obscure Cypriot company called Hermetica Digital Ltd.</p><p>Because operating systems use code-signing as an initial check on software, such a certificate might have been designed to help the rogue program dodge anti-virus protections. Getting such a certificate under false pretenses — or stealing it — isn&#x27;t impossible, but it is generally the sign of a &quot;sophisticated and targeted&quot; operator, said Brian Kime, a vice president at US cybersecurity firm ZeroFox.</p><p>Contact details for Hermetica, which was set up in the Cypriot capital, Nicosia, almost a year ago, were not immediately available. The company did not appear to have a website.</p><p>Earlier on Wednesday the websites of Ukraine&#x27;s government, foreign ministry and state security service were down in what the government said was another denial of service (DDoS) attack.</p><p>&quot;At about 4 p.m., another mass DDoS attack on our state began. We have relevant data from a number of banks,&quot; said Mykhailo Fedorov, Minister of Digital Transformation, adding that the parliament website was also hit.</p><p>He did not say which banks were affected and the central bank could not immediately be reached for comment.</p><p>&quot;Cyber is now simply a component of hybrid warfare,&quot; said Guerrero-Saade.</p><p>Ukraine&#x27;s data protection watchdog said hacks were on the upswing.</p><p>&quot;Phishing attacks on public authorities and critical infrastructure, the spread of malicious software, as well as attempts to penetrate private and public sector networks and further destructive actions have intensified,&quot; it said in an email.</p><p>Last week, the online networks of Ukraine&#x27;s defense ministry and two banks were overwhelmed in a separate intrusion. The US company Netscout Systems Inc NTCT.O later said the impact had been modest. Read full story</p><p>U.S. Senate Intelligence Committee Chairman Mark Warner, speaking to Reuters before news of the wiper was made public, said the denial of services actions against Ukraine were still &quot;well short of what Russia could potentially unleash.&quot;</p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/sports/02/25/22/with-invasion-russia-draws-rebuke-from-sporting-world">From football to F1, what Russia stands to lose in sports</a></li></ul><p>Ukraine has suffered a drumbeat of digital assaults that Kyiv and others have blamed on Russia since 2014 when Moscow annexed the Crimean peninsula and backed a separatist rebellion in eastern Ukraine. The Kremlin has denied any involvement.</p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/overseas/02/24/22/world-leaders-say-attack-on-ukraine-unprovoked-unjustified">&#x27;Unprovoked and unjustified:&#x27; World reacts to attack on Ukraine</a></li></ul><div><em>(Reporting by Christopher Bing and Jonathan Landay in Washington; Maria Tsvetkova and Natalia Zinets in Kyiv; and James Pearson and Raphael Satter in London; Writing by Raphael Satter; Editing by Alex Richardson, Grant McCool and Daniel Wallis)</em></div><div><strong>RELATED VIDEO</strong></div><figure class="op-interactive"><iframe allow="autoplay; fullscreen" frameBorder="0" height="100%" id="ivsplayer01" scrolling="no" src="https://player.ivideosmart.com/ivsplayer/v4/dist/html/iframe-src.html?iframeid=ivsplayer01&amp;key=e8c22c015ca9eafa76f1e3edfa03c603&amp;spid=3001339&amp;vid=1943549" width="100%"></iframe></figure><div class="iwantbar">Watch more in <a href="//www.iwantv.com.ph/">iWantv</a> or <a href="//tfc.tv/">TFC.tv</a></div>

A newly discovered piece of destructive software has hit hundreds of computers, part of an intensifying wave of hacks aimed at the country.