Search This Blog

Showing posts with label Data Wiping Malware. Show all posts

Viasat: Acid Rain Virus Disable Satellite Modems

 

The cyberattack which targeted the KA-SAT satellite broadband service to erase SATCOM modems on February 24 used a newly discovered data wiper virus. It impacted thousands in Ukraine and thousands more across Europe. 

A cybersecurity firm, SentinelOne, claims to have discovered a malware sample, which disrupted internet connectivity on February 24. The malware, called AcidRain, which was also likely utilized in the Viasat breach, is a Unix executable application which is meant to attack MIPS-based devices. This could indicate the attackers' lack of experience with the filesystem and firmware of the targeted devices, or their desire to create a reusable tool.

The same sample came from SkyLogic, the Viasat operator in charge of the damaged network, which is also situated in Italy. The software sample was also tagged with the moniker "ukrop," which could be a reference to the Ukraine Operation. 

The researchers underscored that Viasat did not offer technical indicators of compromise or a detailed incident response report. Instead, rogue commands damaged modems in Ukraine and other European countries, according to the satellite industry. The SentinelOne duo were perplexed as to how valid orders could produce such mayhem in the modem, "scalable disruption is more feasibly performed by delivering an update, script, or executable," they added. 

The program wipes the system and various storage device files completely. AcidRain executes an initial repetitive replacement and removal of non-standard files in the filesystem if the malware is launched as root "Juan Andres Guerrero-Saade and Max van Amerongen," SentinelOne threat experts, revealed. 

The wipers overwrite file structures with up to 0x40000 bytes of data or utilize MEMGETINFO, MEMUNLOCK, MEMERASE, and MEMWRITEOOB input/output control (IOCTL) service calls to erase data on compromised devices. 

The fact Viasat has supplied nearly 30,000 modems to get clients back online since the February 2022 attack and is still shipping more to speed up service restoration, suggests that SentinelOne's supply-chain threat scenario is correct. The IOCTLs used by this virus also resemble those used by the VPNFilter malware 'dstr' wiper plugin, a destructive program linked to Russian GRU hackers. 

The Ukrainian Computer Emergency Response Team recently stated a data wiper known as DoubleZero had been used in assaults on Ukrainian businesses. On the same day that Russia invaded Ukraine, they discovered IsaacWiper, a data wiper, and HermeticWizard, a new worm which dropped HermeticWiper payloads. ESET has discovered a fourth data-destroying malware strain called CaddyWiper, which wipes data across Windows domains and eliminates user data and partition information from associated drivers. 

Microsoft discovered a sixth wiper, now known as WhisperGate, in mid-January, which was being used in data-wiping attacks targeting Ukraine while masquerading as ransomware.

Cyberattack Disrupts Gas Stations Across Iran, Government Says

 

A software failure suspected to be the result of a cyberattack has affected gas stations across Iran and defaced gas pump displays and billboards with gas prices. 

The problem, which occurred on Tuesday had an impact on the IT network of  National Iranian Oil Products Distribution Company (NIOPDC), a state-owned gas distribution firm that control gas stations throughout Iran. The network, which has been supplying oil products for over 80 years, consists of more than 3,500 stations across the country.

According to local media sources and as well as photographs and videos posted on social media, the cyberattack led NIOPDC gas stations to display the words "cyberattack 64411" on their screens. The gas pumps could have been used to refill automobiles, but NIOPDC staff shut them off once the firm learned it couldn't trace and charge consumers for the fuel they poured in their vehicles. 

Additionally, NIOPDC-installed gas pricing signs in key cities displayed the same "cyberattack 64411" message, along with "Khamenei, where is the gas?" and "Free gas at [local gas station's name]." 

The phone number 64411 is for the office of Supreme Leader Ayatollah Ali Khamenei. The same number was also displayed on billboards at Iranian train stations during a cyberattack on July 9, when passengers were instructed to phone Iran's leader and inquire as to why their trains had been delayed. The July attack on Iranian train stations was eventually connected to Meteor, a type of data-wiping malware. 

Despite a flood of evidence shared on social media, the Ministry of Oil spokesperson dismissed reports of a "cyberattack" in an official statement made later and attributed the occurrence to a software glitch, according to Jahan News. The same publication later claimed that refuelling operations at impacted gas stations had resumed. 

Government officials also held an emergency conference in response to the event, and after getting a reprimand from the Iranian leadership, several Iranian news agencies deleted reports of a cyberattack.