February 17, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – Lazarus APT Group – IOCs
March 25, 2022Rewterz Threat Alert – Cobalt Strike Malware – Active IOCs
March 25, 2022Rewterz Threat Alert – Lazarus APT Group – IOCs
March 25, 2022Rewterz Threat Alert – Cobalt Strike Malware – Active IOCs
March 25, 2022
Severity
Medium
Analysis Summary
Trojan.Killdisk is a new disk-wiping malware recently discovered by security researchers. The wiper attacks are targeted towards Ukraine in support of the Russian invasion, and these signatures can also be seen in attacks in Lithuania. Targeted sectors are aviation, defense, IT services, and financial sector.
HermeticWiper (Trojan.Killdisk) is interestingly digitally signed by a certificate issued to Hermetica Digital Ltd (the origin of the name).
Upon execution, HermeticWiper will damage the MBR (Master Boot Record) of the victim’s system, which will render it inoperable. Organizations compromised using this wiper date back to November of 2021. A Microsoft SQL Server vulnerability was also used to attack organizations in Ukraine and along with the wiper, ransomware was also deployed against affected organizations.
Impact
- Data Loss
- File Encryption
- Financial Loss
Indicators of Compromise
MD5
- decc2726599edcae8d1d1d0ca99d83a6
SHA-256
- 3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767
SHA-1
- 0d8cc992f279ec45e8b8dfd05a700ff1f0437f29
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.