SwiftSlicer Wiper Hits Ukraine

Ukraine again became a cyber victim of Russia that involved the deployment of a Golang-based data wiper dubbed SwiftSlicer that attributed to the attack of Sandworm

Sandworm, a nation-state group linked to Military Unit 74455 of the Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).

The wiper, once executed it deletes shadow copies, recursively and overwrites the files located in the below paths

%CSIDL_SYSTEM%\drivers
%CSIDL_SYSTEM_DRIVE%\Windows\NTDS
other non-system drives and then reboots computer.

The overwrites are achieved by using randomly generated byte sequences to fill 4,096 byte-length blocks.

The sophistication of the Sandworm threat actor is evidenced by its multiple distinct kill chains, which comprise a wide variety of custom tools such as BlackEnergy, GreyEnergy, Industroyer, NotPetya, Exaramel, and Cyclops Blink.

Last year, while Russia’s military invasion of Ukraine, Sandworm, has unleashed WhisperGate, HermeticWiper, IsaacWiper, CaddyWiper, Industroyer2, Prestige, and RansomBoggs against critical infrastructure in Ukraine.

The discovery of SwiftSlicer points to the consistent use of wiper malware variants by the Russian adversarial collective in attacks designed to wreak havoc in Ukraine.

Indicators of Compromise