Threats Tagged 'pathwiper'

This intelligence report emphasizes the importance of understanding one's own environment and personal weaknesses in cybersecurity. It stresses the need for repeatable processes to maintain knowledge of one's environment and advocates for continuous learning to fill skill gaps. The report also highlights recent vulnerability disclosures by Cisco Talos across various software, including catdoc, Parallel, NVIDIA, and High-Logic FontCreator. It underscores the significance of promptly applying patches and remaining vigilant against potential exploits. Additionally, the report touches on recent cyber incidents affecting the NHS, United Natural Foods, and vulnerabilities in Google accounts and SinoTrack GPS devices.

MediumMalwareUnited KingdomGermanyFrance+7#critical infrastructure#ransomware#patch management

A destructive attack on Ukrainian critical infrastructure using a new wiper malware called 'PathWiper' has been observed. The attack, attributed to a Russia-nexus APT group, utilized a legitimate endpoint administration framework to deploy the wiper across connected endpoints. PathWiper overwrites file system artifacts with random data, targeting physical drives, volumes, and network shared drives. Its capabilities are similar to HermeticWiper, previously used against Ukrainian entities. The malware's sophisticated approach to identifying and corrupting connected drives and volumes distinguishes it from earlier wipers. This attack underscores the ongoing threat to Ukrainian infrastructure despite the prolonged conflict with Russia.

MediumMalwareUkrainePolandGermany+9#wiper#apt#pathwiper