Microsoft warns full scope of Ukraine cyber attacks ‘not fully realised’

Microsoft has investigated the cyber attacks in Ukraine and revealed evidence of a targeted malware campaign that disguises itself as ransomware, but offers no recourse for victims to recover their data. 

The so-called ‘fake ransomware’ was examined by Microsoft’s Threat Intelligence Center (MSTIC), which concluded that the “destructive malware” was designed to render targeted machines inoperable rather than to attract a ransom payment.

Microsoft’s analysis of the malware revealed other inconsistencies between it and traditional ransomware. While a ransom sum and cryptocurrency wallet address are provided, the way in which the malware is designed means victims wouldn’t be able to recover their data even if they did pay to $10,000 ransom demanded in the note.

MSTIC said the malware works by overwriting the Master Boot Record (MBR) on victim systems, leaving a ransom note (above). The MBR is the part of a hard drive that tells the computer how to load its operating system.

Overwriting the MBR is not common with financially motivated ransomware operators since a destructed MBR means files are destroyed with no mechanism for recovery. If this were the case with typical ransomware, there would be no motivation to pay.

Other differences between the malware hitting Ukraine and ransomware include a uniform ransom demand – usually these are tailored to each victim, a lack of customer ID number in the note, and the communication method being over the Tox encrypted messaging protocol – usually victims are directed to a dark web site owned by the ransomware operator where they can seek support.

The investigation into the attack is ongoing but MSTIC suggested the current malware infection may continue to spread beyond the “dozens” of machines that are already affected. Said machines span sectors including government, non-profits, and IT organisations.

MSTIC also said it’s currently unsure at what stage in the attackers’ operational cycle they’re currently or how many other victims there may be across the country, but the scale of the attack most likely isn’t fully realised at present. 

“Given the scale of the observed intrusions, MSTIC is not able to assess intent of the identified destructive actions but does believe these actions represent an elevated risk to any government agency, non-profit or enterprise located or with systems in Ukraine,” said MSTIC in a blog post. 

“We strongly encourage all organisations to immediately conduct a thorough investigation and to implement defences using the information provided in this post. MSTIC will update this blog as we have additional information to share.”

Geopolitical tensions in the region

The revelations shed more light on the issue first reported last week and follow a lengthy period of unproductive talks, held recently in Geneva, between the US and Russia on the topic of Ukraine.

Most recently, Ukraine officials have said they believe Belarus, a close ally of Russia, is behind the wave of cyber attacks on the nation, adding that the malware used bears resemblance to similar strains previously used by Russian intelligence, Reuters reported.

Ukraine and Russia have been locked in a war over territory since 2014 and there are strong fears that Russia, which has amassed troops at the Ukrainian border, may invade Ukraine as a result of the conflict.

Russia is desperately trying to prevent Ukraine from joining European institutions such as Nato, a demand the West rejects. A war between the two nations is not thought to be imminent, but tensions are arguably at the highest they have been in decades.