IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Microsoft warns full scope of Ukraine cyber attacks ‘not fully realised’

The company's investigation into the attacks targeting Ukraine revealed atypical characteristics of the "destructive" campaign that disguises itself as ransomware

Microsoft has investigated the cyber attacks in Ukraine and revealed evidence of a targeted malware campaign that disguises itself as ransomware, but offers no recourse for victims to recover their data. 

The so-called 'fake ransomware' was examined by Microsoft's Threat Intelligence Center (MSTIC), which concluded that the "destructive malware" was designed to render targeted machines inoperable rather than to attract a ransom payment.

Microsoft's analysis of the malware revealed other inconsistencies between it and traditional ransomware. While a ransom sum and cryptocurrency wallet address are provided, the way in which the malware is designed means victims wouldn't be able to recover their data even if they did pay to $10,000 ransom demanded in the note.

An image of the ransom note found on victim machines in Ukraine

Microsoft

MSTIC said the malware works by overwriting the Master Boot Record (MBR) on victim systems, leaving a ransom note (above). The MBR is the part of a hard drive that tells the computer how to load its operating system.

Overwriting the MBR is not common with financially motivated ransomware operators since a destructed MBR means files are destroyed with no mechanism for recovery. If this were the case with typical ransomware, there would be no motivation to pay.

Other differences between the malware hitting Ukraine and ransomware include a uniform ransom demand - usually these are tailored to each victim, a lack of customer ID number in the note, and the communication method being over the Tox encrypted messaging protocol - usually victims are directed to a dark web site owned by the ransomware operator where they can seek support.

The investigation into the attack is ongoing but MSTIC suggested the current malware infection may continue to spread beyond the "dozens" of machines that are already affected. Said machines span sectors including government, non-profits, and IT organisations.

MSTIC also said it's currently unsure at what stage in the attackers' operational cycle they're currently or how many other victims there may be across the country, but the scale of the attack most likely isn't fully realised at present. 

"Given the scale of the observed intrusions, MSTIC is not able to assess intent of the identified destructive actions but does believe these actions represent an elevated risk to any government agency, non-profit or enterprise located or with systems in Ukraine," said MSTIC in a blog post

"We strongly encourage all organisations to immediately conduct a thorough investigation and to implement defences using the information provided in this post. MSTIC will update this blog as we have additional information to share."

Geopolitical tensions in the region

Related Resource

Global security insights report 2021

Extended enterprise under threat

Whitepaper front coverFree download

The revelations shed more light on the issue first reported last week and follow a lengthy period of unproductive talks, held recently in Geneva, between the US and Russia on the topic of Ukraine.

Most recently, Ukraine officials have said they believe Belarus, a close ally of Russia, is behind the wave of cyber attacks on the nation, adding that the malware used bears resemblance to similar strains previously used by Russian intelligence, Reuters reported.

Ukraine and Russia have been locked in a war over territory since 2014 and there are strong fears that Russia, which has amassed troops at the Ukrainian border, may invade Ukraine as a result of the conflict.

Russia is desperately trying to prevent Ukraine from joining European institutions such as Nato, a demand the West rejects. A war between the two nations is not thought to be imminent, but tensions are arguably at the highest they have been in decades. 

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

What is cyber warfare?
Security

What is cyber warfare?

20 May 2022
Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
Out-of-hours ransomware attacks have a greater impact on revenue
ransomware

Out-of-hours ransomware attacks have a greater impact on revenue

18 Nov 2021

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Preparing for the 3G sunset
Network & Internet

Preparing for the 3G sunset

18 May 2022
(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security
Careers & training

(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security

17 May 2022