###### Report OSINT # Russia/ Ukraine Conflict Cyberaspect Version: 1.0 Classification: Confidential Essential ###### TLP: white Disclosure is not limited Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. Fokkerstraat 4 3833 LD Leusden The Netherlands i ----- Tesorion – Russia/ Ukraine Conflict Cyberaspect ###### Preface Following the recent attacks affecting mainly Ukraine and the Baltic States, this document provides an OSINT scan on the cyber aspects of the Russia-Ukraine conflict. For example, last month large numbers of infections were observed, related to the WhisperGate/Hermetic Wiper trojans, intended to make infected systems unusable, as well as the Cyclops Blink malware. The most commonly mentioned threat actor behind these malware attacks is the SandWorm APT group. This group was also responsible for previous large-scale malware attacks on Ukraine, such as NotPetya, which also caused a lot of damage in Western Europe. With regard to the threat posed by the malware families and threat actors mentioned in this report, Tesorion is assuming on the one hand that infections will spread unintentionally to other countries, for example in Western Europe, and on the other hand that parties in this region will also be active. There is also a risk of further escalation in which the Netherlands and other EU countries, possibly as a result of sanctions or other punitive measures, become the deliberate target of threat actors behind these malware families. For example, when the EU decides to exclude Russia and the SWIFT payment system. The information in this report is derived from OSINT sources and public information published during the past month. The technical indicators such as IP addresses, malware hashes and Yara signatures can be used for the purpose of detecting and blocking malicious traffic. The remainder of this report thus provides more information on the following topics: - Malware Families & Threat Actors - Indicators of Compromise - Newsarticles & Security Advisories Tesorion does not own the copyright for the technical information provided. This information originates from various IT Security companies and National CERTs. Our Security Monitoring Services is closely monitoring the geopolitical conflict. The current situation is monitored through various threat intelligence feeds that are continuously updated. We make every effort to process this rapidly changing data. For those clients whom we are servicing with Immunity Services, Managed Firewall and other services, please note that the IOC’s (Indicators of Compromise) are added to our services. _Author:_ _Tesorion Nederland B.V._ _Classification:_ _Public_ _Published_ _2022_ _Version_ _:_ _1.0_ _© 2022 Tesorion Nederland B.V._ _contact@tesorion.com_ _All rights reserved._ _Nothing from this publication can be reproduced, stored_ _in an automated database and/or disclosed in any form_ _or in any manner whatsoever, electronically,_ _mechanically, through photocopying, recording or any_ _other manner, without prior written consent of the_ _publisher. The information in this document is based on_ _publicly available sources. Tesorion is not necessarily the_ _owner thereof. The information has been collected to_ _inform our customers as well as possible and to provide_ _them with Open-Source Intelligence._ ----- Tesorion – Russia/ Ukraine Conflict Cyberaspect ###### Malware Families & Threat Actors Malware Families - BlackEnergy (Sandworm Tool 2015) - Industroyer (Sandworm Tool 2016) - NotPetya (Sandworm Tool 2017) - WhisperGate (Wiper) - HermeticWiper / Killdisk.NCV (Wiper) - Cyclops Blink (Sandworm Tool) - VPNFilter (Replaced by Cyclops Blink) - Katana (DDoS Botnet) Threat Actors - Sandworm APT ###### Indicators of Compromise _Malware Hashes_ 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591 (unknown, wiper) 912342F1C840A42F6B74132F8A7C4FFE7D40FB77 (HermeticWiper/Killdisk.NCV) 61B25D11392172E587D8DA3045812A66C3385451 (HermeticWiper/Killdisk.NCV) 3F4A16B29F2F0532B7CE3E7656799125 (HermeticWiper/Killdisk.NCV) 5d5c99a08a7d927346ca2dafa7973fc1 (WhisperGate) a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92 (WhisperGate) dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78 (WhisperGate) ff17ccd8c96059461710711fcc8372cfea5f0f9eb566ceb6ab709ea871190dc6 (Cyclops Blink) 4e69bbb61329ace36fbe62f9fb6ca49c37e2e5a5293545c44d155641934e39d1 (Cyclops Blink) 50df5734dd0c6c5983c21278f119527f9fdf6ef1d7e808a29754ebc5253e9a86 (Cyclops Blink) c082a9117294fa4880d75a2625cf80f63c8bb159b54a7151553969541ac35862 (Cyclops Blink) 82c426d9b8843f279ab9d5d2613ae874d0c359c483658d01e92cc5ac68f6ebcf (Katana DDoS Botnet) 978672b911f0b1e529c9cf0bca824d3d3908606d0545a5ebbeb6c4726489a2ed (Katana DDoS Botnet) _IP Addresses_ Katana Botnet Indicators of Compromise - 5.182.211[.]5 on the port 60195 / http://5.182.211[.]5/rip.sh `o` Cyclops Blink Indicators of compromise - 100.43.220[.]234 - 96.80.68[.]193 - 188.152.254[.]170 - 208.81.37[.]50 - 70.62.153[.]174 - 2.230.110[.]137 - 90.63.245[.]175 - 212.103.208[.]182 - 50.255.126[.]65 - 78.134.89[.]167 - 81.4.177[.]118 ----- Tesorion – Russia/ Ukraine Conflict Cyberaspect - 24.199.247[.]222 - 37.99.163[.]162 - 37.71.147[.]186 - 105.159.248[.]137 - 80.155.38[.]210 - 217.57.80[.]18 - 151.0.169[.]250 - 212.202.147[.]10 - 212.234.179[.]113 - 185.82.169[.]99 - 93.51.177[.]66 - 80.15.113[.]188 - 80.153.75[.]103 - 109.192.30[.]125 _Yara Signatures_ Yara Rule Katana DDoS Botnet rule Ddos_Linux_Katana { meta: description = "Detects Mirai variant named Katana" date = "2022-02-19" license = "Apache License 2.0" hash = "82c426d9b8843f279ab9d5d2613ae874d0c359c483658d01e92cc5ac68f6ebcf" strings: $ = "[http flood] fd%d started connect" $ = "Failed to set IP_HDRINCL. Aborting" $ = "[OVH] DDoS Started" $ = "[vega/table] tried to access table.%d but it is locked" $ = "Cannot send DNS flood without a domain" condition: all of them } Yara Rule Cyclops Blink rule CyclopsBlink_notable_strings { meta: author = "NCSC" description = "Detects notable strings identified within the Cyclops Blink executable" hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863" hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8" strings: // Process names masqueraded by implant $proc_name1 = "[kworker/0:1]" $proc_name2 = "[kworker/1:1]" // DNS query over SSL, used to resolve C2 server address $dns_query = "POST /dns-query HTTP/1.1\x0d\x0aHost: dns.google\x0d\x0a" // iptables commands $iptables1 = "iptables -I %s -p tcp --dport %d -j ACCEPT &>/dev/null" $iptables2 = "iptables -D %s -p tcp --dport %d -j ACCEPT &>/dev/null" // Format strings used for system recon $sys_recon1 = "{\"ver\":\"%x\",\"mods\";[" $sys_recon2 = "uptime: %lu mem_size: %lu mem_free: %lu" $sys_recon3 = "disk_size: %lu disk_free: %lu" ----- Tesorion – Russia/ Ukraine Conflict Cyberaspect $sys_recon4 = "hw: %02x:%02x:%02x:%02x:%02x:%02x" // Format string for filepath used to test access to device filesystem $testpath = "%s/214688dsf46" // Format string for implant configuration filepath $confpath = "%s/rootfs_cfg" // Default file download path $downpath = "/var/tmp/a.tmp" condition: (uint32(0) == 0x464c457f) and (8 of them) } rule CyclopsBlink_module_initialisation { meta: author = "NCSC" description = "Detects the code bytes used to initialise the modules built into Cyclops Blink" hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863" hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8" strings: // Module initialisation code bytes, simply returning the module ID // to the caller $ = {94 21 FF F0 93 E1 00 08 7C 3F 0B 78 38 00 00 ?? 7C 03 03 78 81 61 00 00 8E EB FF F8 7D 61 5B 78 4E 80 00 20} condition: (uint32(0) == 0x464c457f) and (any of them) } rule CyclopsBlink_modified_install_upgrade { meta: author = "NCSC" description = "Detects notable strings identified within the modified install_upgrade executable, embedded within Cyclops Blink" hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863" hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8" hash3 = "7d61c0dd0cd901221a9dff9df09bb90810754f10" hash4 = "438cd40caca70cafe5ca436b36ef7d3a6321e858" strings: // Format strings used for temporary filenames $ = "/pending/%010lu_%06d_%03d_p1" $ = "/pending/sysa_code_dir/test_%d_%d_%d_%d_%d_%d" // Hard-coded key used to initialise HMAC calculation $ = "etaonrishdlcupfm" // Filepath used to store the patched firmware image $ = "/pending/WGUpgrade-dl.new" // Filepath of legitimate install_upgrade executable $ = "/pending/bin/install_upgraded" // Loop device IOCTL LOOP_SET_FD $ = {38 80 4C 00} // Loop device IOCTL LOOP_GET_STATUS64 $ = {38 80 4C 05} // Loop device IOCTL LOOP_SET_STATUS64 $ = {38 80 4C 04} // Firmware HMAC record starts with the string "HMAC" $ = {3C 00 48 4D 60 00 41 43 90 09 00 00} ----- Tesorion – Russia/ Ukraine Conflict Cyberaspect condition: (uint32(0) == 0x464c457f) and (6 of them) } rule CyclopsBlink_core_command_check { meta: author = "NCSC" description = "Detects the code bytes used to test the command ID being sent to the core component of Cyclops Blink" hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863" hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8" strings: // Check for command ID equals 0x7, 0xa, 0xb, 0xc or 0xd $cmd_check = {81 3F 00 18 88 09 00 05 54 00 06 3E 2F 80 00 (07|0A|0B|0C|0D)} condition: (uint32(0) == 0x464c457f) and (#cmd_check == 5) rule CyclopsBlink_config_identifiers { meta: author = "NCSC" description = "Detects the initial characters used to identify Cyclops Blink configuration data" hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863" hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8" strings: // Main config parameter data starts with the string "