Wipers from Russia’s most cut-throat hackers rain destruction on Ukraine

In a chilling escalation of cyber warfare, the notorious Russian hacking group Sandworm has initiated a series of aggressive cyberattacks against Ukraine amid the ongoing conflict with Russia. Researchers unveiled these developments on Thursday, detailing how the group has employed devastating malware known as wipers, designed to permanently erase sensitive data and disrupt critical infrastructure. In April, Sandworm specifically attacked a Ukrainian university with two distinct wipers, including one dubbed Sting. This particular malware targeted numerous Windows computers, executing a scheduled task with a name that translates to a casual Russian phrase about eating goulash. The second variant, identified as Zerlot, also played a role in these malicious operations. The onslaught continued throughout June and September, with Sandworm unleashing various wiper types on a range of vital Ukrainian sectors, including government agencies, energy providers, and logistics firms. Notably, the hackers also shifted their focus to the agricultural sector, targeting organizations involved in Ukraine's grain industry, which is crucial for the nation's economy. As highlighted by ESET, while these sectors have been common targets for wiper attacks since 2022, the grain industry is less frequently assaulted. This shift suggests a strategic move to undermine Ukraine's economic stability during wartime, as grain exports are a significant source of revenue for the country. Wipers have emerged as a favored weapon for Russian cyber operatives since at least 2012, gaining notoriety with the NotPetya worm. Initially aimed at Ukraine, this self-replicating malware quickly spiraled out of control, leading to widespread international disruption and causing an estimated tens of billions of dollars in damages as it paralyzed thousands of organizations for extended periods.