Cyber experts have identified a new strain of computer-disabling malware unleashed on Ukrainian targets as part of Russia’s offensive, as the UK government and banks said they were on alert for online attacks.
Russia was widely expected to launch a cyber assault alongside its military campaign, and the run-up to the invasion of Ukraine was marked by the deployment of “wiper” malware . A distributed denial-of-service (DDoS) attack, which paralyses websites by bombarding them with spurious information requests, also hit Ukrainian government sites.
On Thursday, requests for volunteers from Ukraine’s hacker underground began to appear on forums in a bid to help protect critical infrastructure and conduct cyber spying missions against Russian troops, Reuters reported, citing two sources.
“Ukrainian cybercommunity! It’s time to get involved in the cyber defense of our country,” one post read. Yegor Aushev, co-founder of a cybersecurity company in Kyiv, told Reuters he wrote the post at the request of a senior defence ministry official who contacted him on Thursday. Aushev’s firm Cyber Unit Technologies is known for working with Ukraine’s government on the defence of critical infrastructure.
On Wednesday, ESET Research Labs, a Slovakia-based cybersecurity company, said it had detected a new piece of data-wiping malware on hundreds of machines in Ukraine.
ESET said large organisations had been affected, while security experts at Symantec’s threat intelligence team said the malware had affected Ukrainian government contractors in Latvia and Lithuania and a financial institution in Ukraine. ESET has called the malware, which renders computers inoperable by disabling rebooting, HermeticWiper.
The NotPetya attack of 2017, which devastated Ukrainian businesses, was a wiper attack that encrypted computers irretrievably and spilled over into other countries, causing $10bn (£7.5bn) of damage worldwide.
Alexi Drew, a senior analyst at RAND Europe, a research institute, said cyber offensives carried the risk of escalating rapidly if attacks spill over widely into other countries, although in the case of HermeticWiper the malware does not appear to be self-propogating, whereas NotPetya was able to spread. Further attacks, however, could be different, she added. “There’s a history of cyber-attacks not staying where they’re meant to go. If you look at NotPetya, the splash damage there was significant. There is a danger here of escalation because offensive cyber activity is fundamentally not very good at staying where you put it.”
Priti Patel said officials were on alert for cyber-attacks and disinformation campaigns from Moscow. “As we monitor developments, we will be especially mindful of the potential for cyber-attacks and disinformation emanating from Russia,” the home secretary said.
