New Report Reveals NikoWiper Malware That Targeted Ukraine Energy Sector

Jan 31, 2023Ravie LakshmananCyber War / Malware

The Russia-affiliated Sandworm used yet another wiper malware
strain dubbed NikoWiper as part of an attack that
took place in October 2022 targeting an energy sector company in
Ukraine.

“The NikoWiper is based on SDelete^[1], a command line utility
from Microsoft that is used for securely deleting files,”
cybersecurity company ESET revealed^[2]
in its latest APT Activity Report shared with The Hacker News.

The Slovak cybersecurity firm said the attacks coincided with
missile strikes^[3]
orchestrated by the Russian armed forces aimed at the Ukrainian
energy infrastructure, suggesting overlaps in objectives.

The disclosure comes merely days after ESET attributed Sandworm
to a Golang-based data wiper dubbed SwiftSlicer^[4]
that was deployed against an unnamed Ukrainian entity on January
25, 2023.

The advanced persistent threat (APT) group linked to Russia’s
foreign military intelligence agency GRU has also been implicated
in a partially successful attack targeting national news agency
Ukrinform, deploying as many as five different wipers on
compromised machines.

The Computer Emergency Response Team of Ukraine (CERT-UA)
identified the five wiper variants as CaddyWiper^[5], ZeroWipe, SDelete,
AwfulShred^[6], and BidSwipe. The first
three of these targeted Windows systems, while AwfulShred and
BidSwipe took aim at Linux and FreeBSD systems.

The use of SDelete is notable, as it suggests that Sandworm has
been experimenting with the utility as a wiper in at least two
different instances to cause irrevocable damage to the targeted
organizations in Ukraine.

That said, ESET malware researcher Robert Lipovsky told The
Hacker News that “NikoWiper is a different malware.”

Besides weaponizing SDelete, Sandworm’s recent campaigns have
also leveraged bespoke ransomware families, including Prestige^[7]
and RansomBoggs^[8], to lock victim data
behind encryption barriers without any option to recover them.

The efforts are the latest indication that the use of
destructive wiper malware is on the rise and is being increasingly
adopted as a cyber weapon of choice among Russian hacking
crews.

“Wipers have not been used widely as they’re targeted weapons,”
BlackBerry’s Dmitry Bestuzhev told The Hacker News in a statement.
“Sandworm has been actively working on developing wipers and
ransomware families used explicitly for Ukraine.”

It’s not just Sandworm, as other Russian state-sponsored outfits
such as APT29, Callisto, and Gamaredon have engaged in parallel
efforts to cripple Ukrainian infrastructure via spear-phishing
campaigns designed to facilitate backdoor access and credential
theft.

According to Recorded Future, which tracks APT29^[9]
(aka Nobelium) under the moniker BlueBravo, the APT has been
connected to new compromised infrastructure that’s likely employed
as a lure to deliver a malware loader codenamed
GraphicalNeutrino.

The loader, whose main function is to deliver follow-on malware,
abuses Notion’s API for command-and-control (C2) communications as
well as the platform’s database feature to store victim information
and stage payloads for download.

“Any country with a nexus to the Ukraine crisis, particularly
those with key geopolitical, economic, or military relationships
with Russia or Ukraine, are at increased risk of targeting,” the
company said^[10] in a technical report
published last week.

The shift to Notion, a legitimate note-taking application,
underscores^[11] APT29’s “broadening but
continued use” of popular software services like Dropbox, Google
Drive, and Trello to blend malware traffic and circumvent
detection.

Although no second-stage malware was detected, ESET – which also
found a sample of the malware in October 2022 – theorized it was
“aimed at fetching and executing Cobalt Strike^[12].”

The findings also come close on the heels of Russia stating^[13] that it was the target
of “coordinated aggression” in 2022 and that it faced
“unprecedented external cyber attacks” from “intelligence agencies,
transnational IT corporations, and hacktivists.”

As the Russo-Ukrainian war officially enters its twelfth month,
it remains to be seen how the conflict evolves forward in the cyber
realm.

“Over the past year we have seen waves of increased activity –
such as in the spring after the invasion, in the fall and quieter
months over the summer – but overall there’s been a nearly constant
stream of attacks,” Lipovsky said. “So one thing that we can be
sure about is that we will be seeing more cyber attacks.”