{
	"id": "fea79774-56ea-4756-a47b-09fb0da24d32",
	"created_at": "2026-04-06T00:10:36.885471Z",
	"updated_at": "2026-04-10T03:20:33.08259Z",
	"deleted_at": null,
	"sha1_hash": "f1fc6e15c16df56c54fcfb784aaffa936904d026",
	"title": "Putin Warns Russian Critical Infrastructure to Brace for Potential Cyber Attacks",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 177762,
	"plain_text": "Putin Warns Russian Critical Infrastructure to Brace for Potential\r\nCyber Attacks\r\nBy The Hacker News\r\nPublished: 2022-02-25 · Archived: 2026-04-05 22:43:22 UTC\r\nThe Russian government on Thursday warned of cyber attacks aimed at domestic critical infrastructure operators,\r\nas the country's full-blown invasion of Ukraine enters the second day.\r\nIn addition to cautioning of the \"threat of an increase in the intensity of computer attacks,\" Russia's National\r\nComputer Incident Response and Coordination Center said that the \"attacks can be aimed at disrupting the\r\nfunctioning of important information resources and services, causing reputational damage, including for political\r\npurposes.\"\r\n\"Any failure in the operation of [critical information infrastructure] objects due to a reason that is not reliably\r\nestablished, first of all, should be considered as the result of a computer attack,\" the agency added.\r\nFurthermore, it notified of possible influence operations undertaken to \"form a negative image of the Russian\r\nFederation in the eyes of the world community,\" echoing a similar alert released by the U.S. Cybersecurity and\r\nInfrastructure Security Agency (CISA) last week about information manipulation efforts from foreign actors to\r\nstrike critical entities.\r\nhttps://thehackernews.com/2022/02/putin-warns-russian-critical.html\r\nPage 1 of 3\n\nThe agency, however, didn't share more specifics on the nature of the attacks or their provenance.\r\nThe advisory comes as multiple government and banking websites in Russia, including that of military (mil.ru),\r\nthe Kremlin (kremlin.ru), and the State Duma (duma.gov.ru), were rendered unreachable amid a spate of cyber\r\noffensives targeting Ukraine that resulted in the deployment of a data wiper called HermeticWiper on hundreds of\r\nmachines in the East European nation.\r\n\"It's important to note that the wiper leverages high privileges on the compromised host to make the host\r\n'unbootable' by overriding the boot records and configurations, erase device configurations, and delete shadow\r\ncopies,\" Lavi Lazarovitz, head of security research at CyberArk Labs, said in a statement shared with The Hacker\r\nNews.\r\n\"The wiper is configured to not encrypt domain controllers – that is to keep the domain running and allow the\r\nransomware to use valid credentials to authenticate to servers and encrypt those. This further highlights that the\r\nthreat actors use compromised identities to access the network and / or move laterally,\" Lazarovitz elaborated.\r\nIt's not clear how many networks have been affected by the previously unseen data-wiping malware, which\r\ntargeted organizations in the financial, defense, aviation, and IT industries, according to Symantec. The\r\nBroadcom-owned company also said it observed evidence of wiper attacks against machines in Lithuania,\r\nimplying a spillover effect.\r\nWhat's more, HermeticWiper shares overlaps with another data wiper called WhisperGate that was first reported\r\nas being used against Ukrainian organizations in January. Like the latter, the newly discovered malware is\r\naccompanied by the distribution of a ransomware strain on compromised systems.\r\nThe ransomware malware is a 64-bit, 3.14 MB .EXE file, written in Golang, per Cybereason's incident response\r\nengineer, Chen Erlich, who shared a preliminary analysis of the executable.\r\n\"It appears likely that the ransomware was used as a decoy or distraction from the wiper attacks,\" Symantec said.\r\n\"This has some similarities to the earlier WhisperGate wiper attacks against Ukraine, where the wiper was\r\ndisguised as ransomware.\"\r\nInitial forensic analysis suggests that the attacks may have been in preparation mode for at least three months,\r\nwhat with potentially related malicious activity detected in a Lithuanian organization as early as November 12,\r\n2021. Also, one of the HermeticWiper samples was found to have a compilation timestamp of December 28, 2021.\r\nhttps://thehackernews.com/2022/02/putin-warns-russian-critical.html\r\nPage 2 of 3\n\nWhile the latest disruptive actions are yet to be formally attributed, the U.K. and U.S. governments linked\r\nthe DDoS attacks on Ukraine in mid-February to Russia's Main Intelligence Directorate (also known as GRU).\r\nAs the attacks continue to unfold both on the physical and digital realms, Reuters reported that the Ukrainian\r\ngovernment is seeking the help of the underground hacker community in the country to fend off cyber infiltrations\r\naimed at critical infrastructure and conduct covert espionage missions against the invading Russian forces.\r\nFound this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content\r\nwe post.\r\nSource: https://thehackernews.com/2022/02/putin-warns-russian-critical.html\r\nhttps://thehackernews.com/2022/02/putin-warns-russian-critical.html\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://thehackernews.com/2022/02/putin-warns-russian-critical.html"
	],
	"report_names": [
		"putin-warns-russian-critical.html"
	],
	"threat_actors": [],
	"ts_created_at": 1775434236,
	"ts_updated_at": 1775791233,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/f1fc6e15c16df56c54fcfb784aaffa936904d026.pdf",
		"text": "https://archive.orkl.eu/f1fc6e15c16df56c54fcfb784aaffa936904d026.txt",
		"img": "https://archive.orkl.eu/f1fc6e15c16df56c54fcfb784aaffa936904d026.jpg"
	}
}