{"id":17599,"date":"2022-03-01T02:24:08","date_gmt":"2022-03-01T02:24:08","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/03\/01\/new-foxblade-malware-used-to-target-ukraine-before-invasion\/"},"modified":"2022-03-01T02:24:08","modified_gmt":"2022-03-01T02:24:08","slug":"new-foxblade-malware-used-to-target-ukraine-before-invasion","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/03\/01\/new-foxblade-malware-used-to-target-ukraine-before-invasion\/","title":{"rendered":"New ‘FoxBlade’ malware used to target Ukraine before invasion"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Microsoft Corp. has detailed a new form of malware that was used against targets in Ukraine in the hours before the start of the Russian invasion.<\/p>\n

Dubbed \u201cFoxBlade\u201d by researchers at the Microsoft Threat Intelligence Center, the malware is described<\/a> as a Trojan that can use computers for distributed denial-of-service attacks without the owners\u2019 knowledge.<\/p>\n

In a blog post<\/a>, Microsoft President and Vice-Chair Brad Smith said that the malware was being used for offensive and destructive cyberattacks against Ukraine\u2019s digital infrastructure.<\/p>\n

\u201cThese recent and ongoing cyberattacks have been precisely targeted and we have not seen the use of the indiscriminate malware technology that spread across Ukraine\u2019s economy and beyond its borders in the 2017 NotPetya attack,\u201d Smith explained. \u201cBut we remain especially concerned about recent cyberattacks on Ukrainian civilian digital targets, including the financial sector, agriculture sector, emergency response services, humanitarian aid efforts and energy sector organizations and enterprises.\u201d<\/p>\n

The FoxBlade attacks were not the only cyber surprise to emerge from Russia. A joint cyber alert<\/a> from the U.S. Department of Homeland Security\u2019s Cybersecurity and Infrastructure Security Agency has warned of two other new forms of malware being used against organizations in Ukraine.<\/p>\n

The first \u2013 Whispergate, was also discovered<\/a> by researchers at Microsoft and is intended to be destructive, rendering targeted devices inoperable. The second \u2013 HermeticWiper, was discovered<\/a> by researchers at SentielOne Inc. and targets Windows devices. The malware manipulates the master boot record, resulting in a subsequent boot failure.<\/p>\n

\u201cIt makes sense that Microsoft would observe an increase of cyberattacks targeting Ukraine in these last few days,\u201d Hank Schless, senior manager, security solutions at\u00a0endpoint-to-cloud security company Lookout Inc.<\/a>, told SiliconANGLE. \u201cEven before the Russians invaded, there were a couple of attacks that seemed like tests before more advanced ones were launched. While there\u2019s very little that\u2019s been shared about FoxBlade, it sounds like Microsoft is suggesting that the actors behind its development created it for the purpose of targeting critical infrastructure in Ukraine.\u201d<\/p>\n

Schless added that there\u00a0have also been reports of phishing campaigns targeting Ukrainians on social media platforms. \u201cWhen there\u2019s a level of uncertainty about something going on in the world, phishing can be one of the most effective tactics for attackers to use,\u201d Schless explained. \u201cThreat actors leverage our innate need for information against us by executing phishing campaigns across SMS, email, third party message platforms, and social media apps in particular.\u201d<\/p>\n

Nathan Einwechter, director of security research at cybersecurity company Vectra AI Inc.<\/a> emphasized that\u00a0FoxBlade is a malicious Trojan installed on systems to enable DDoS attacks.<\/p>\n

\u201cThis means that the malware isn\u2019t deployed within the target environments, but instead installed on as many targets of opportunities as possible,\u201d\u00a0Einwechter said. \u201cOnce enough systems are under their control, the infected machines can be collectively controlled to knock the actual target (i.e. Ukrainian critical infrastructure) off the internet by flooding their public network connections with more traffic than they can handle.\u201d<\/p>\n

\u201cThis is an important distinction, as it means that any individual or company may be a target of infection by FoxBlade and, consequently, used unwittingly to degrade internet access within Ukraine or other targets of Russian interest,\u201d\u00a0Einwechter added.<\/p>\n

Photo: Max Pixel<\/a><\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n