{"id":3325,"date":"2022-01-17T20:17:41","date_gmt":"2022-01-17T20:17:41","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/17\/microsoft-uncovers-malware-campaign-targeting-organizations-in-ukraine\/"},"modified":"2022-01-17T20:17:41","modified_gmt":"2022-01-17T20:17:41","slug":"microsoft-uncovers-malware-campaign-targeting-organizations-in-ukraine","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/17\/microsoft-uncovers-malware-campaign-targeting-organizations-in-ukraine\/","title":{"rendered":"Microsoft uncovers malware campaign targeting organizations in Ukraine"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Microsoft Corp. has uncovered a hacking campaign that targets organizations in Ukraine with destructive malware designed to render their computers unusable.\u00a0<\/span><\/p>\n

The company detailed the hacking campaign in a Saturday <\/span>blog post<\/span><\/a>. Previously, a cyberattack last week took about 70 Ukrainian government websites temporarily offline. According to the <\/span>Financial Times<\/span><\/a>, Ukraine\u2019s digital transformation ministry said that \u201call evidence points to Russia being behind the attack\u201d that targeted the government websites last week.\u00a0\u00a0<\/span><\/p>\n

The malware used as part of the hacking campaign uncovered by Microsoft first appeared on computers in Ukraine on Jan. 13, the company stated. Microsoft said it has detected the malware on dozens of systems across multiple government, nonprofit and information technology organizations.<\/span><\/p>\n

\u201cWe do not know the current stage of this attacker\u2019s operational cycle or how many other victim organizations may exist in Ukraine or other geographic locations,\u201d Microsoft detailed in the blog post. \u201cHowever, it is unlikely these impacted systems represent the full scope of impact as other organizations are reporting.\u201d<\/span><\/p>\n

The malware used in the hacking campaign, Microsoft detailed, is designed to appear as ransomware. But instead of encrypting files as ransomware cyberattacks usually do, the malware discovered by Microsoft makes data on the devices that it targets unusable.<\/span><\/p>\n

Microsoft determined that the malware carries out cyberattacks in two stages.<\/span><\/p>\n

During the first stage, the malware overwrites a section of the infected computer\u2019s hard drive that is known as the Master Boot Record, or MBR. The section contains information that the operating system needs to load when a computer starts. The malware overwrites the MBR to display a ransom note when the compromised\u00a0 machine boots.<\/span><\/p>\n

According to Microsoft, the malware activates the second stage of the cyberattack when the infected computer is powered down. In the second stage, a malicious payload is downloaded that scans the computer for files with certain file extensions. Then the malicious payload overwrites the contents of the files that it finds and renames them.<\/span><\/p>\n

Microsoft has released updates for its Microsoft Defender Antivirus and Microsoft Defender for Endpoint cybersecurity products to facilitate detection of the malware. The tools can detect the malware in both on-premises and cloud environments, the company said.<\/span><\/p>\n

\u201cWe are continuing the investigation and will share significant updates with affected customers, as well as public and private sector partners, as [we] get more information,\u201d Microsoft\u2019s cybersecurity researchers wrote.\u00a0<\/span><\/p>\n

Image: Unsplash<\/a><\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n