SYMBOLCOMMON_NAMEaka. SYNONYMS
win.whispergate (Back to overview)

WhisperGate

aka: PAYWIPE

Destructive malware deployed against targets in Ukraine in January 2022.

References
2022-05-19BlackberryThe BlackBerry Research & Intelligence Team
@online{team:20220519:net:ecf311c, author = {The BlackBerry Research & Intelligence Team}, title = {{.NET Stubs: Sowing the Seeds of Discord (PureCryter)}}, date = {2022-05-19}, organization = {Blackberry}, url = {https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord}, language = {English}, urldate = {2022-05-24} } .NET Stubs: Sowing the Seeds of Discord (PureCryter)
404 Keylogger Agent Tesla Amadey AsyncRAT Ave Maria BitRAT BluStealer Formbook LimeRAT Loki Password Stealer (PWS) Nanocore RAT Orcus RAT Quasar RAT Raccoon RedLine Stealer WhisperGate
2022-05-19BlackberryThe BlackBerry Research & Intelligence Team
@online{team:20220519:net:64662b5, author = {The BlackBerry Research & Intelligence Team}, title = {{.NET Stubs: Sowing the Seeds of Discord}}, date = {2022-05-19}, organization = {Blackberry}, url = {https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord?}, language = {English}, urldate = {2022-05-23} } .NET Stubs: Sowing the Seeds of Discord
Agent Tesla Quasar RAT WhisperGate
2022-04-28FortinetGergely Revay
@online{revay:20220428:overview:0ac963f, author = {Gergely Revay}, title = {{An Overview of the Increasing Wiper Malware Threat}}, date = {2022-04-28}, organization = {Fortinet}, url = {https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat}, language = {English}, urldate = {2022-04-29} } An Overview of the Increasing Wiper Malware Threat
AcidRain CaddyWiper DistTrack DoubleZero EternalPetya HermeticWiper IsaacWiper Olympic Destroyer Ordinypt WhisperGate ZeroCleare
2022-04-27MicrosoftMicrosoft Digital Security Unit (DSU)
@online{dsu:20220427:special:f1a2031, author = {Microsoft Digital Security Unit (DSU)}, title = {{Special Report: Ukraine An overview of Russia’s cyberattack activity in Ukraine}}, date = {2022-04-27}, organization = {Microsoft}, url = {https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Vwwd}, language = {English}, urldate = {2022-05-03} } Special Report: Ukraine An overview of Russia’s cyberattack activity in Ukraine
CaddyWiper DoubleZero HermeticWiper INDUSTROYER2 IsaacWiper PartyTicket WhisperGate
2022-04-07InQuestWill MacArthur, Nick Chalard
@online{macarthur:20220407:ukraine:99bef5a, author = {Will MacArthur and Nick Chalard}, title = {{Ukraine CyberWar Overview}}, date = {2022-04-07}, organization = {InQuest}, url = {https://inquest.net/blog/2022/04/07/ukraine-cyberwar-overview}, language = {English}, urldate = {2022-04-29} } Ukraine CyberWar Overview
CyclopsBlink Cobalt Strike GraphSteel GrimPlant HermeticWiper HermeticWizard MicroBackdoor PartyTicket Saint Bot Scieron WhisperGate
2022-03-30CrowdStrikeCrowdStrike Threat Intel Team
@online{team:20220330:who:f73e255, author = {CrowdStrike Threat Intel Team}, title = {{Who is EMBER BEAR?}}, date = {2022-03-30}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/who-is-ember-bear/}, language = {English}, urldate = {2022-03-31} } Who is EMBER BEAR?
WhisperGate
2022-03-14KasperskyGReAT
@online{great:20220314:webinar:f6bfb3c, author = {GReAT}, title = {{Webinar on cyberattacks in Ukraine – summary and Q&A}}, date = {2022-03-14}, organization = {Kaspersky}, url = {https://securelist.com/webinar-on-cyberattacks-in-ukraine-summary-and-qa/106075/}, language = {English}, urldate = {2022-04-05} } Webinar on cyberattacks in Ukraine – summary and Q&A
HermeticWiper HermeticWizard IsaacWiper PartyTicket WhisperGate
2022-03-11BitdefenderRadu Crahmaliuc
@online{crahmaliuc:20220311:five:9ba5aa0, author = {Radu Crahmaliuc}, title = {{Five Things You Need to Know About the Cyberwar in Ukraine}}, date = {2022-03-11}, organization = {Bitdefender}, url = {https://www.bitdefender.com/blog/hotforsecurity/five-things-you-need-to-know-about-the-cyberwar-in-ukraine/}, language = {English}, urldate = {2022-03-31} } Five Things You Need to Know About the Cyberwar in Ukraine
HermeticWiper WhisperGate
2022-03-10BrightTALK (Kaspersky GReAT)Costin Raiu, Marco Preuss, Kurt Baumgartner, Dan Demeter, Ivan Kwiatkowski
@online{raiu:20220310:brighttalk:a3d9072, author = {Costin Raiu and Marco Preuss and Kurt Baumgartner and Dan Demeter and Ivan Kwiatkowski}, title = {{BrightTALK: A look at current cyberattacks in Ukraine}}, date = {2022-03-10}, organization = {BrightTALK (Kaspersky GReAT)}, url = {https://www.brighttalk.com/webcast/15591/534324}, language = {English}, urldate = {2022-04-05} } BrightTALK: A look at current cyberattacks in Ukraine
HermeticWiper HermeticWizard IsaacWiper PartyTicket WhisperGate
2022-03-04MandiantJames Sadowski, Ryan Hall
@online{sadowski:20220304:responses:0b94dae, author = {James Sadowski and Ryan Hall}, title = {{Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation}}, date = {2022-03-04}, organization = {Mandiant}, url = {https://www.mandiant.com/resources/russia-invasion-ukraine-retaliation}, language = {English}, urldate = {2022-03-07} } Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation
HermeticWiper PartyTicket WhisperGate
2022-03-03Trend MicroTrend Micro Research
@techreport{research:20220303:ioc:216aad3, author = {Trend Micro Research}, title = {{IOC Resource for Russia-Ukraine Conflict-Related Cyberattacks}}, date = {2022-03-03}, institution = {Trend Micro}, url = {https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict/IOC%20Resource%20for%20Russia-Ukraine%20Conflict-Related%20Cyberattacks-03032022.pdf}, language = {English}, urldate = {2022-03-04} } IOC Resource for Russia-Ukraine Conflict-Related Cyberattacks
ClipBanker Conti HermeticWiper PartyTicket WhisperGate
2022-03-03LIFARSLIFARS
@online{lifars:20220303:closer:f29cc25, author = {LIFARS}, title = {{A Closer Look at the Russian Actors Targeting Organizations in Ukraine}}, date = {2022-03-03}, organization = {LIFARS}, url = {https://lifars.com/2022/03/a-closer-look-at-the-russian-actors-targeting-organizations-in-ukraine/}, language = {English}, urldate = {2022-03-04} } A Closer Look at the Russian Actors Targeting Organizations in Ukraine
HermeticWiper IsaacWiper Saint Bot WhisperGate
2022-03-03Trend MicroTrend Micro Research
@online{research:20220303:cyberattacks:d961eb0, author = {Trend Micro Research}, title = {{Cyberattacks are Prominent in the Russia-Ukraine Conflict}}, date = {2022-03-03}, organization = {Trend Micro}, url = {https://www.trendmicro.com/en_us/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict.html}, language = {English}, urldate = {2022-03-04} } Cyberattacks are Prominent in the Russia-Ukraine Conflict
BazarBackdoor Cobalt Strike Conti Emotet WhisperGate
2022-02-28MicrosoftMSRC Team
@online{team:20220228:cyber:8ef46fd, author = {MSRC Team}, title = {{Cyber threat activity in Ukraine: analysis and resources}}, date = {2022-02-28}, organization = {Microsoft}, url = {https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine}, language = {English}, urldate = {2022-03-07} } Cyber threat activity in Ukraine: analysis and resources
HermeticWiper IsaacWiper PartyTicket WhisperGate
2022-02-26CISACISA, FBI
@techreport{cisa:20220226:destructive:be5862b, author = {CISA and FBI}, title = {{Destructive Malware Targeting Organizations in Ukraine}}, date = {2022-02-26}, institution = {CISA}, url = {https://www.cisa.gov/uscert/sites/default/files/publications/AA22-057A_Destructive_Malware_Targeting_Organizations_in_Ukraine.pdf}, language = {English}, urldate = {2022-03-01} } Destructive Malware Targeting Organizations in Ukraine
HermeticWiper WhisperGate
2022-02-26CISA
@online{cisa:20220226:alert:48440b6, author = {CISA}, title = {{Alert (AA22-057A) Destructive Malware Targeting Organizations in Ukraine}}, date = {2022-02-26}, url = {https://www.cisa.gov/uscert/ncas/alerts/aa22-057a}, language = {English}, urldate = {2022-03-01} } Alert (AA22-057A) Destructive Malware Targeting Organizations in Ukraine
HermeticWiper WhisperGate
2022-02-25The Hacker NewsRavie Lakshmanan
@online{lakshmanan:20220225:putin:09a1fea, author = {Ravie Lakshmanan}, title = {{Putin Warns Russian Critical Infrastructure to Brace for Potential Cyber Attacks}}, date = {2022-02-25}, organization = {The Hacker News}, url = {https://thehackernews.com/2022/02/putin-warns-russian-critical.html}, language = {English}, urldate = {2022-03-01} } Putin Warns Russian Critical Infrastructure to Brace for Potential Cyber Attacks
HermeticWiper WhisperGate
2022-02-25CyberPeace Institute
@online{institute:20220225:ukraine:eb66e34, author = {CyberPeace Institute}, title = {{UKRAINE: Timeline of Cyberattacks}}, date = {2022-02-25}, url = {https://cyberpeaceinstitute.org/ukraine-timeline-of-cyberattacks}, language = {English}, urldate = {2022-03-01} } UKRAINE: Timeline of Cyberattacks
VPNFilter EternalPetya HermeticWiper WhisperGate
2022-02-24TesorionTESORION
@techreport{tesorion:20220224:report:e2f2082, author = {TESORION}, title = {{Report OSINT: Russia/ Ukraine Conflict Cyberaspect}}, date = {2022-02-24}, institution = {Tesorion}, url = {https://www.tesorion.nl/en/resources/pdfstore/Report-OSINT-Russia-Ukraine-Conflict-Cyberaspect.pdf}, language = {English}, urldate = {2022-03-01} } Report OSINT: Russia/ Ukraine Conflict Cyberaspect
Mirai VPNFilter BlackEnergy EternalPetya HermeticWiper Industroyer WhisperGate
2022-02-24nvisoMichel Coene
@online{coene:20220224:threat:f0dba09, author = {Michel Coene}, title = {{Threat Update – Ukraine & Russia conflict}}, date = {2022-02-24}, organization = {nviso}, url = {https://blog.nviso.eu/2022/02/24/threat-update-ukraine-russia-tensions/}, language = {English}, urldate = {2022-03-01} } Threat Update – Ukraine & Russia conflict
EternalPetya GreyEnergy HermeticWiper Industroyer KillDisk WhisperGate
2022-02-23The RecordCatalin Cimpanu
@online{cimpanu:20220223:second:960453d, author = {Catalin Cimpanu}, title = {{Second data wiper attack hits Ukraine computer networks}}, date = {2022-02-23}, organization = {The Record}, url = {https://therecord.media/second-data-wiper-attack-hits-ukraine-computer-networks/}, language = {English}, urldate = {2022-03-01} } Second data wiper attack hits Ukraine computer networks
HermeticWiper WhisperGate
2022-02-15Intel 471Intel 471
@online{471:20220215:how:c105692, author = {Intel 471}, title = {{How the Russia-Ukraine conflict is impacting cybercrime}}, date = {2022-02-15}, organization = {Intel 471}, url = {https://intel471.com/blog/russia-ukraine-conflict-cybercrime-underground}, language = {English}, urldate = {2022-02-17} } How the Russia-Ukraine conflict is impacting cybercrime
WhisperGate
2022-02-10InQuestJosiah Smith
@online{smith:20220210:380glowspark:6e3a6c6, author = {Josiah Smith}, title = {{+380-GlowSpark}}, date = {2022-02-10}, organization = {InQuest}, url = {https://inquest.net/blog/2022/02/10/380-glowspark}, language = {English}, urldate = {2022-02-17} } +380-GlowSpark
GlowSpark WhisperGate
2022-02-03YouTube (Malfind Labs)Lasq
@online{lasq:20220203:analyzing:7e58c93, author = {Lasq}, title = {{Analyzing WhisperGate - destructive malware targeting Ukraine - part 1}}, date = {2022-02-03}, organization = {YouTube (Malfind Labs)}, url = {https://www.youtube.com/watch?v=Ek3URIaC5O8}, language = {English}, urldate = {2022-02-07} } Analyzing WhisperGate - destructive malware targeting Ukraine - part 1
WhisperGate
2022-02-03BlackberryThe BlackBerry Research & Intelligence Team
@online{team:20220203:threat:0ee1428, author = {The BlackBerry Research & Intelligence Team}, title = {{Threat Spotlight: WhisperGate Wiper Wreaks Havoc in Ukraine}}, date = {2022-02-03}, organization = {Blackberry}, url = {https://blogs.blackberry.com/en/2022/02/threat-spotlight-whispergate-wiper-wreaks-havoc-in-ukraine}, language = {English}, urldate = {2022-03-02} } Threat Spotlight: WhisperGate Wiper Wreaks Havoc in Ukraine
WhisperGate
2022-02-01Cyborg SecurityBrandon Denker
@techreport{denker:20220201:whispergate:1eca84b, author = {Brandon Denker}, title = {{WhisperGate Malware - Update}}, date = {2022-02-01}, institution = {Cyborg Security}, url = {https://info.cyborgsecurity.com/hubfs/Emerging%20Threats/WhisperGate%20Malware%20Update%20-%20Emerging%20Threat.pdf}, language = {English}, urldate = {2022-02-10} } WhisperGate Malware - Update
WhisperGate
2022-02-01Max Kersten's BlogMax Kersten
@online{kersten:20220201:dumping:2784605, author = {Max Kersten}, title = {{Dumping WhisperGate’s wiper from an Eazfuscator obfuscated loader}}, date = {2022-02-01}, organization = {Max Kersten's Blog}, url = {https://maxkersten.nl/binary-analysis-course/malware-analysis/dumping-whispergates-wiper-from-an-eazfuscator-obfuscated-loader/}, language = {English}, urldate = {2022-02-02} } Dumping WhisperGate’s wiper from an Eazfuscator obfuscated loader
WhisperGate
2022-01-31CrowdStrikeSarang Sonawane, Liviu Arsene
@online{sonawane:20220131:crowdstrike:1fd4945, author = {Sarang Sonawane and Liviu Arsene}, title = {{CrowdStrike Falcon Proactively Protects Against Wiper Malware as CISA Warns U.S. Companies of Potential Attacks}}, date = {2022-01-31}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/how-crowdstrike-protects-against-data-wiping-malware/}, language = {English}, urldate = {2022-02-02} } CrowdStrike Falcon Proactively Protects Against Wiper Malware as CISA Warns U.S. Companies of Potential Attacks
WhisperGate
2022-01-28CrowdStrikeCrowdStrike Intelligence Team
@online{team:20220128:lessons:fc2d4c6, author = {CrowdStrike Intelligence Team}, title = {{Lessons Learned From Successive Use of Offensive Cyber Operations Against Ukraine and What May Be Next}}, date = {2022-01-28}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/lessons-from-past-cyber-operations-against-ukraine/}, language = {English}, urldate = {2022-02-01} } Lessons Learned From Successive Use of Offensive Cyber Operations Against Ukraine and What May Be Next
WhisperGate
2022-01-28Recorded FutureInsikt Group®
@online{group:20220128:whispergate:304e5df, author = {Insikt Group®}, title = {{WhisperGate Malware Corrupts Computers in Ukraine}}, date = {2022-01-28}, organization = {Recorded Future}, url = {https://www.recordedfuture.com/whispergate-malware-corrupts-computers-ukraine/}, language = {English}, urldate = {2022-02-04} } WhisperGate Malware Corrupts Computers in Ukraine
WhisperGate
2022-01-27GigamonJoe Slowik
@online{slowik:20220127:focusing:5b47208, author = {Joe Slowik}, title = {{Focusing on “Left of Boom”}}, date = {2022-01-27}, organization = {Gigamon}, url = {https://blog.gigamon.com/2022/01/28/focusing-on-left-of-boom/}, language = {English}, urldate = {2022-02-02} } Focusing on “Left of Boom”
WhisperGate
2022-01-27splunkSplunk Threat Research Team
@online{team:20220127:threat:ea9f405, author = {Splunk Threat Research Team}, title = {{Threat Advisory: STRT-TA02 - Destructive Software}}, date = {2022-01-27}, organization = {splunk}, url = {https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html}, language = {English}, urldate = {2022-02-01} } Threat Advisory: STRT-TA02 - Destructive Software
WhisperGate
2022-01-27BlackberryThe BlackBerry Research & Intelligence Team
@online{team:20220127:threat:68af23b, author = {The BlackBerry Research & Intelligence Team}, title = {{Threat Thursday: WhisperGate Wiper Targets Government, Non-profit, and IT Organizations in Ukraine}}, date = {2022-01-27}, organization = {Blackberry}, url = {https://blogs.blackberry.com/en/2022/01/threat-thursday-whispergate-wiper}, language = {English}, urldate = {2022-02-01} } Threat Thursday: WhisperGate Wiper Targets Government, Non-profit, and IT Organizations in Ukraine
WhisperGate
2022-01-27Recorded FutureJohn Wetzel
@techreport{wetzel:20220127:russias:e336cc8, author = {John Wetzel}, title = {{Russia’s Biggest Threat Is Its Instability}}, date = {2022-01-27}, institution = {Recorded Future}, url = {https://go.recordedfuture.com/hubfs/reports/pov-2022-0127.pdf}, language = {English}, urldate = {2022-02-04} } Russia’s Biggest Threat Is Its Instability
WhisperGate
2022-01-27splunkSplunk Threat Research Team
@online{team:20220127:threat:6829079, author = {Splunk Threat Research Team}, title = {{Threat Advisory: STRT-TA02 - Destructive Software}}, date = {2022-01-27}, organization = {splunk}, url = {https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html?splunk}, language = {English}, urldate = {2022-02-02} } Threat Advisory: STRT-TA02 - Destructive Software
WhisperGate
2022-01-26NetskopeGustavo Palazolo
@online{palazolo:20220126:netskope:8a29793, author = {Gustavo Palazolo}, title = {{Netskope Threat Coverage: WhisperGate}}, date = {2022-01-26}, organization = {Netskope}, url = {https://www.netskope.com/blog/netskope-threat-coverage-whispergate}, language = {English}, urldate = {2022-01-31} } Netskope Threat Coverage: WhisperGate
WhisperGate
2022-01-26Cert-UACert-UA
@online{certua:20220126:fragment:f64191e, author = {Cert-UA}, title = {{Fragment of cyberattack research 14.01.2022}}, date = {2022-01-26}, organization = {Cert-UA}, url = {https://cert.gov.ua/article/18101}, language = {Ukrainian}, urldate = {2022-01-28} } Fragment of cyberattack research 14.01.2022
WhisperGate
2022-01-22csirt-moncsirt-mon
@online{csirtmon:20220122:analysis:25ca045, author = {csirt-mon}, title = {{Analysis of the Cyberattack on Ukrainian Government Resources}}, date = {2022-01-22}, organization = {csirt-mon}, url = {https://csirt-mon.wp.mil.pl/pl/articles6-aktualnosci/analysis-cyberattack-ukrainian-government-resources/}, language = {English}, urldate = {2022-01-28} } Analysis of the Cyberattack on Ukrainian Government Resources
WhisperGate
2022-01-21Zero DayKim Zetter
@online{zetter:20220121:hackers:335d7dd, author = {Kim Zetter}, title = {{Hackers Were in Ukraine Systems Months Before Deploying Wiper}}, date = {2022-01-21}, organization = {Zero Day}, url = {https://zetter.substack.com/p/hackers-were-in-ukraine-systems-months}, language = {English}, urldate = {2022-01-25} } Hackers Were in Ukraine Systems Months Before Deploying Wiper
WhisperGate
2022-01-21SecureworksCounter Threat Unit ResearchTeam
@online{researchteam:20220121:whispergate:bcdbf9d, author = {Counter Threat Unit ResearchTeam}, title = {{WhisperGate: Not NotPetya}}, date = {2022-01-21}, organization = {Secureworks}, url = {https://www.secureworks.com/blog/whispergate-not-notpetya}, language = {English}, urldate = {2022-01-25} } WhisperGate: Not NotPetya
WhisperGate
2022-01-21Github (OALabs)OALabs
@online{oalabs:20220121:whispergate:e235152, author = {OALabs}, title = {{WhisperGate Malware}}, date = {2022-01-21}, organization = {Github (OALabs)}, url = {https://github.com/OALabs/Lab-Notes/blob/main/WhisperGate/WhisperGate.ipynb}, language = {English}, urldate = {2022-01-25} } WhisperGate Malware
WhisperGate
2022-01-21Talos IntelligenceNick Biasini, Michael Chen, Chris Neal, Matt Olney, Dmytro Korzhevin
@online{biasini:20220121:ukraine:e0da072, author = {Nick Biasini and Michael Chen and Chris Neal and Matt Olney and Dmytro Korzhevin}, title = {{Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation}}, date = {2022-01-21}, organization = {Talos Intelligence}, url = {https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html}, language = {English}, urldate = {2022-01-25} } Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation
WhisperGate
2022-01-21SecureworksCounter Threat Unit ResearchTeam
@online{researchteam:20220121:disruptive:fff238c, author = {Counter Threat Unit ResearchTeam}, title = {{Disruptive Attacks in Ukraine Likely Linked to Escalating Tensions}}, date = {2022-01-21}, organization = {Secureworks}, url = {https://www.secureworks.com/blog/disruptive-attacks-in-ukraine-likely-linked-to-escalating-tensions}, language = {English}, urldate = {2022-01-25} } Disruptive Attacks in Ukraine Likely Linked to Escalating Tensions
WhisperGate
2022-01-20Palo Alto Networks Unit 42Robert Falcone, Mike Harbison, Josh Grunzweig
@online{falcone:20220120:threat:4aad471, author = {Robert Falcone and Mike Harbison and Josh Grunzweig}, title = {{Threat Brief: Ongoing Russia and Ukraine Cyber Conflict}}, date = {2022-01-20}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/}, language = {English}, urldate = {2022-01-24} } Threat Brief: Ongoing Russia and Ukraine Cyber Conflict
WhisperGate
2022-01-20TrellixChristiaan Beek, Max Kersten, Raj Samani
@online{beek:20220120:return:a89bce6, author = {Christiaan Beek and Max Kersten and Raj Samani}, title = {{Return of Pseudo Ransomware}}, date = {2022-01-20}, organization = {Trellix}, url = {https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/return-of-pseudo-ransomware.html}, language = {English}, urldate = {2022-01-24} } Return of Pseudo Ransomware
WhisperGate
2022-01-20LIFARSVlad Pasca
@online{pasca:20220120:detailed:87c1f12, author = {Vlad Pasca}, title = {{A Detailed Analysis of WhisperGate Targeting Ukrainian Organizations}}, date = {2022-01-20}, organization = {LIFARS}, url = {https://lifars.com/2022/01/a-detailed-analysis-of-whispergate-targeting-ukrainian-organizations/}, language = {English}, urldate = {2022-01-24} } A Detailed Analysis of WhisperGate Targeting Ukrainian Organizations
WhisperGate
2022-01-20TrellixRaj Samani, Mo Cashman, Taylor Mullins
@online{samani:20220120:update:43f230d, author = {Raj Samani and Mo Cashman and Taylor Mullins}, title = {{Update on WhisperGate, Destructive Malware Targeting Ukraine – Threat Intelligence & Protections Update}}, date = {2022-01-20}, organization = {Trellix}, url = {https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/update-on-whispergate-destructive-malware-targeting-ukraine.html}, language = {English}, urldate = {2022-01-25} } Update on WhisperGate, Destructive Malware Targeting Ukraine – Threat Intelligence & Protections Update
WhisperGate
2022-01-20Twitter (@nunohaien)Tillmann Werner
@online{werner:20220120:key:d2605ca, author = {Tillmann Werner}, title = {{Tweet on key points of Whispergate wiper}}, date = {2022-01-20}, organization = {Twitter (@nunohaien)}, url = {https://twitter.com/nunohaien/status/1484088885575622657}, language = {English}, urldate = {2022-01-24} } Tweet on key points of Whispergate wiper
WhisperGate
2022-01-19ElasticDaniel Stepanic, Samir Bousseaden, James Spiteri, Joe Desimone, Mark Mager, Andrew Pease
@online{stepanic:20220119:operation:c81f473, author = {Daniel Stepanic and Samir Bousseaden and James Spiteri and Joe Desimone and Mark Mager and Andrew Pease}, title = {{Operation Bleeding Bear}}, date = {2022-01-19}, organization = {Elastic}, url = {https://elastic.github.io/security-research/malware/2022/01/01.operation-bleeding-bear/article/}, language = {English}, urldate = {2022-01-24} } Operation Bleeding Bear
WhisperGate
2022-01-19CrowdStrikeCrowdStrike Intelligence Team
@online{team:20220119:technical:8a81c7e, author = {CrowdStrike Intelligence Team}, title = {{Technical Analysis of the WhisperGate Malicious Bootloader}}, date = {2022-01-19}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/technical-analysis-of-whispergate-malware/}, language = {English}, urldate = {2022-01-20} } Technical Analysis of the WhisperGate Malicious Bootloader
WhisperGate
2022-01-19Youtube (HEXORCIST)Nicolas Brulez
@online{brulez:20220119:whispergate:a81ff16, author = {Nicolas Brulez}, title = {{WhisperGate: MBR Wiper Malware Analysis. Ukraine Cyber Attack 2022}}, date = {2022-01-19}, organization = {Youtube (HEXORCIST)}, url = {https://www.youtube.com/watch?v=2nd-f1dIfD4}, language = {English}, urldate = {2022-01-24} } WhisperGate: MBR Wiper Malware Analysis. Ukraine Cyber Attack 2022
WhisperGate
2022-01-19rxOred's blogrxored
@online{rxored:20220119:whispergate:39880e3, author = {rxored}, title = {{WhisperGate}}, date = {2022-01-19}, organization = {rxOred's blog}, url = {https://rxored.github.io/post/analysis/whispergate/whispergate/}, language = {English}, urldate = {2022-01-24} } WhisperGate
WhisperGate
2022-01-18MicrosoftMicrosoft 365 Defender Threat Intelligence Team
@online{team:20220118:evolved:87fc647, author = {Microsoft 365 Defender Threat Intelligence Team}, title = {{Evolved phishing: Device registration trick adds to phishers’ toolbox for victims without MFA}}, date = {2022-01-18}, organization = {Microsoft}, url = {https://www.microsoft.com/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa/}, language = {English}, urldate = {2022-01-31} } Evolved phishing: Device registration trick adds to phishers’ toolbox for victims without MFA
WhisperGate
2022-01-18S2W Inc.BLKSMTH
@online{blksmth:20220118:analysis:f6d259e, author = {BLKSMTH}, title = {{Analysis of Destructive Malware (WhisperGate) targeting Ukraine}}, date = {2022-01-18}, organization = {S2W Inc.}, url = {https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3}, language = {English}, urldate = {2022-01-19} } Analysis of Destructive Malware (WhisperGate) targeting Ukraine
WhisperGate
2022-01-18Twitter (@knight0x07)neeraj
@online{neeraj:20220118:thread:f5c7756, author = {neeraj}, title = {{Thread on yet another comprehensive analysis of WHISPERGATE}}, date = {2022-01-18}, organization = {Twitter (@knight0x07)}, url = {https://twitter.com/knight0x07/status/1483401072102502400}, language = {English}, urldate = {2022-01-31} } Thread on yet another comprehensive analysis of WHISPERGATE
WhisperGate
2022-01-18zetter substackKim Zetter
@online{zetter:20220118:dozens:55ba77a, author = {Kim Zetter}, title = {{Dozens of Computers in Ukraine Wiped with Destructive Malware in Coordinated Attack}}, date = {2022-01-18}, organization = {zetter substack}, url = {https://zetter.substack.com/p/dozens-of-computers-in-ukraine-wiped}, language = {English}, urldate = {2022-01-24} } Dozens of Computers in Ukraine Wiped with Destructive Malware in Coordinated Attack
WhisperGate
2022-01-18StairwellSilas Cutler
@online{cutler:20220118:whispers:c986974, author = {Silas Cutler}, title = {{Whispers in the noise}}, date = {2022-01-18}, organization = {Stairwell}, url = {https://stairwell.com/news/whispers-in-the-noise-microsoft-ukraine-whispergate/}, language = {English}, urldate = {2022-01-19} } Whispers in the noise
WhisperGate
2022-01-17Twitter (@Libranalysis)Max Kersten
@online{kersten:20220117:short:d913f54, author = {Max Kersten}, title = {{Tweet on short analysis of WHISPERGATE stage 3 malware}}, date = {2022-01-17}, organization = {Twitter (@Libranalysis)}, url = {https://twitter.com/Libranalysis/status/1483128221956808704}, language = {English}, urldate = {2022-01-25} } Tweet on short analysis of WHISPERGATE stage 3 malware
WhisperGate
2022-01-17Cado SecurityCado Security
@online{security:20220117:resources:a47b0a6, author = {Cado Security}, title = {{Resources for DFIR Professionals Responding to WhisperGate Malware}}, date = {2022-01-17}, organization = {Cado Security}, url = {https://www.cadosecurity.com/resources-for-dfir-professionals-responding-to-whispergate-malware/}, language = {English}, urldate = {2022-01-18} } Resources for DFIR Professionals Responding to WhisperGate Malware
WhisperGate
2022-01-17Twitter (@HuskyHacksMK)Matt | HuskyHacks
@online{huskyhacks:20220117:whispergate:8223b85, author = {Matt | HuskyHacks}, title = {{WhisperGate Wiper Malware Analysis Live Thread}}, date = {2022-01-17}, organization = {Twitter (@HuskyHacksMK)}, url = {https://twitter.com/HuskyHacksMK/status/1482876242047258628}, language = {English}, urldate = {2022-01-25} } WhisperGate Wiper Malware Analysis Live Thread
WhisperGate
2022-01-17Github (Dump-GUY)Jiří Vinopal
@online{vinopal:20220117:debugging:d4899ec, author = {Jiří Vinopal}, title = {{Debugging MBR - IDA + Bochs Emulator (CTF example)}}, date = {2022-01-17}, organization = {Github (Dump-GUY)}, url = {https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/Debugging%20MBR%20-%20IDA%20+%20Bochs%20Emulator/Debugging%20MBR%20-%20IDA%20+%20Bochs%20Emulator.md}, language = {English}, urldate = {2022-01-24} } Debugging MBR - IDA + Bochs Emulator (CTF example)
WhisperGate
2022-01-15MicrosoftTom Burt
@online{burt:20220115:malware:5f4e2d4, author = {Tom Burt}, title = {{Malware attacks targeting Ukraine government (DEV-0586)}}, date = {2022-01-15}, organization = {Microsoft}, url = {https://blogs.microsoft.com/on-the-issues/2022/01/15/mstic-malware-cyberattacks-ukraine-government/}, language = {English}, urldate = {2022-04-15} } Malware attacks targeting Ukraine government (DEV-0586)
WhisperGate
2022-01-15MicrosoftMicrosoft, Microsoft Security Intelligence, Microsoft Digital Security Unit (DSU), Microsoft Detection and Response Team (DART), Microsoft 365 Defender Threat Intelligence Team
@online{microsoft:20220115:destructive:77ac2f5, author = {Microsoft and Microsoft Security Intelligence and Microsoft Digital Security Unit (DSU) and Microsoft Detection and Response Team (DART) and Microsoft 365 Defender Threat Intelligence Team}, title = {{Destructive malware targeting Ukrainian organizations (DEV-0586)}}, date = {2022-01-15}, organization = {Microsoft}, url = {https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/}, language = {English}, urldate = {2022-01-18} } Destructive malware targeting Ukrainian organizations (DEV-0586)
WhisperGate
Yara Rules
[TLP:WHITE] win_whispergate_auto (20220411 | Detects win.whispergate.)
rule win_whispergate_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-04-08"
        version = "1"
        description = "Detects win.whispergate."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whispergate"
        malpedia_rule_date = "20220405"
        malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a"
        malpedia_version = "20220411"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b55b4 0fb6440c0b 3c2f 7426 3c5c 7422 89c8 }
            // n = 7, score = 300
            //   8b55b4               | mov                 edx, dword ptr [ebp - 0x4c]
            //   0fb6440c0b           | movzx               eax, byte ptr [esp + ecx + 0xb]
            //   3c2f                 | cmp                 al, 0x2f
            //   7426                 | je                  0x28
            //   3c5c                 | cmp                 al, 0x5c
            //   7422                 | je                  0x24
            //   89c8                 | mov                 eax, ecx

        $sequence_1 = { 0fbeda 83fb5d 8d7701 0f841a010000 }
            // n = 4, score = 300
            //   0fbeda               | movsx               ebx, dl
            //   83fb5d               | cmp                 ebx, 0x5d
            //   8d7701               | lea                 esi, dword ptr [edi + 1]
            //   0f841a010000         | je                  0x120

        $sequence_2 = { 0f8543010000 83c30c 81fb???????? 0f8389000000 8b13 }
            // n = 5, score = 300
            //   0f8543010000         | jne                 0x149
            //   83c30c               | add                 ebx, 0xc
            //   81fb????????         |                     
            //   0f8389000000         | jae                 0x8f
            //   8b13                 | mov                 edx, dword ptr [ebx]

        $sequence_3 = { a1???????? 890424 e8???????? e8???????? a1???????? }
            // n = 5, score = 300
            //   a1????????           |                     
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   e8????????           |                     
            //   a1????????           |                     

        $sequence_4 = { 5b 5e 5f 5d c3 0fbe57ff 85d2 }
            // n = 7, score = 300
            //   5b                   | pop                 ebx
            //   5e                   | pop                 esi
            //   5f                   | pop                 edi
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   0fbe57ff             | movsx               edx, byte ptr [edi - 1]
            //   85d2                 | test                edx, edx

        $sequence_5 = { 740e 0fb75002 89c6 8d4802 6685d2 75ca 3975e4 }
            // n = 7, score = 300
            //   740e                 | je                  0x10
            //   0fb75002             | movzx               edx, word ptr [eax + 2]
            //   89c6                 | mov                 esi, eax
            //   8d4802               | lea                 ecx, dword ptr [eax + 2]
            //   6685d2               | test                dx, dx
            //   75ca                 | jne                 0xffffffcc
            //   3975e4               | cmp                 dword ptr [ebp - 0x1c], esi

        $sequence_6 = { 89f8 eb85 8b45d4 89e6 890424 e8???????? 83c010 }
            // n = 7, score = 300
            //   89f8                 | mov                 eax, edi
            //   eb85                 | jmp                 0xffffff87
            //   8b45d4               | mov                 eax, dword ptr [ebp - 0x2c]
            //   89e6                 | mov                 esi, esp
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   83c010               | add                 eax, 0x10

        $sequence_7 = { 894c2414 0fb608 0f8437010000 8b442414 }
            // n = 4, score = 300
            //   894c2414             | mov                 dword ptr [esp + 0x14], ecx
            //   0fb608               | movzx               ecx, byte ptr [eax]
            //   0f8437010000         | je                  0x13d
            //   8b442414             | mov                 eax, dword ptr [esp + 0x14]

        $sequence_8 = { f7c280800000 0f840a010000 89d1 00d1 }
            // n = 4, score = 300
            //   f7c280800000         | test                edx, 0x8080
            //   0f840a010000         | je                  0x110
            //   89d1                 | mov                 ecx, edx
            //   00d1                 | add                 cl, dl

        $sequence_9 = { 8b45bc 8b4004 83c304 890424 }
            // n = 4, score = 300
            //   8b45bc               | mov                 eax, dword ptr [ebp - 0x44]
            //   8b4004               | mov                 eax, dword ptr [eax + 4]
            //   83c304               | add                 ebx, 4
            //   890424               | mov                 dword ptr [esp], eax

    condition:
        7 of them and filesize < 114688
}
Download all Yara Rules