uh over the years at Eed we have been
tracking a number of Russian AP groups
uh some of them have been uh active uh
since the beginning of the invasion more
some have been active less uh some from
some we haven't seen any activity uh
some of these groups as you have uh
heard already and know uh have been
attributed to various threel agencies
the uh KGB uh sorry the FSB the svr uh
the Gru and today talk about two of
these groups and I'll begin with the
most aggressive one which is
sandworm so sandworm most known for its
uh cyber uh sabotage uh needs very
little introduction sorm has basically a
thing for wipers that in and of itself
is nothing new sandworms uh wiper
activity goes as far back as their uh
2014 black energy campaigns then the
kill dis series even not Peta was
essentially a uh wiper masquer in as for
ransomware but in the past those
destructive attacks were much more
spread out in time and when the invasion
began um those attacks became became
much more dense uh in fact since the
beginning of the invasion we uh saw
around 20 different uh wiper families
and that's a lot for the uh given time
period uh which is why we've been
calling the uh the period since the
beginning of The Invasion uh the year of
wipers so um I'll highlight some of the
more uh notable ones for example we DET
uh discovered a hermetic wiper on
February 23rd in fact only a couple of
hours before the military aggression
began next I will mention caddy wiper uh
which has been used uh numerous times
afterwards uh it was also one of the
wipers uh deployed in the industry to
incident on April 8th one of the most uh
impactful or important I should say
attacks during the war and caddy wiper
was also used in the October attack
against the power grade that you'll hear
uh more about uh in the upcoming Mania
presentation uh in several cases I would
say that uh the wiper loaders were more
notable uh or interesting than the
wipers themselves for example Argy patch
was a caddy wiper
uh in the form of Shell Code embedded
into a legitimate uh application and in
the industry 2 case that legitimate Abus
application was the remote debugger of
Ida Pro now you might be saying wait a
second Ida Pro I mean when when malware
is taking the form of a legitimate
binary it's typically for the purpose of
masquerading but Ida isn't typically
used at an electric substation it's us
researchers who are using it to analyze
malware so the most likely explanation I
guess was that they were trolling us and
I would say that this hypothesis was
confirmed in in another uh argue patch
deployment and in that case the abused
executable was an EET executable
stripped of his digital
signature okay then uh the summer was
relatively calm there were a couple of
attacks but not as dense as before uh
because Sor probably burned a lot of
their positions that they had built up
prior to the war and built them up at
the beginning uh of of the war and they
needed to create new ones so then there
was another uh more intense uh wave uh
in the fall of last year um there was
the uh Nik wiper attack the first
deployment of Niko wiper uh against an
energy company also there was the power
grid attack that you'll hear more about
later and uh this very much coincides uh
with also the kinetic attacks against
the Ukrainian uh energy sector
especially the power grid um in the fall
of last year Prestige far ransomware is
also uh very notable because uh in
addition to attacking uh Logistics and
transportation companies in Ukraine it
affected companies in Poland as well
which is one of the biggest supporters
uh of
Ukraine uh moving on there were more
cases of wipers masquerading as
ransomware um like somnia or Ransom bogs
with its references to the monster Inc
movie um and then moving on to this year
so in 2023 sandworm was mostly using a
different I would say the trend was
simplifying their approach um so they
would abuse uh legitimate tools for the
wiping action so in these cases it was s
delete which is essentially a legitimate
wiper from Microsoft's internals um then
these Roar bath cases followed continued
that trend Trend uh but that legitimate
abuse application was WinRAR uh so rbat
is a really simple uh batch script as
you can see here it Roars uh it looks
for files first of certain file
extensions and then Roars them using the
DF switch um which deletes the files
after they've been added to the archive
and then afterwards the archive itself
is deleted as
well so that April attack was against a
government institution and then in June
the target was auk Ian media
organization and what's interesting is
that uh that Roar bat uh variant was
actually specifically tailored to that
attack because it was going after media
files which are typically used in such
companies then in July we detected two
attacks using a new version of Niko
wiper and in August another attack
against an energy company where sandworm
uh used sharp Niko wiper which is
essentially a c variant of Niko wiper
and even Niko wiper follows this trend
of abusing legitimate tools uh for the
wiping uh as you can see here it's
launching a file called ahx that's
actually as
delete and there was an very interesting
element uh found in this new ni wiper
version uh the attacker left a pdb path
in the binary and we can observe two
things here so first they named the
project uh chelom uh which is probably
this guy uh Vladimir chelom uh an
engineer and designer in the Soviet
missile program and second they left a
false flag they named they used the name
mikita which is specifically a Ukrainian
not a Russian first name Russian would
be Nikita with an
N so that's it for this super quick uh
sandworm update and let's move on to the
other group which is gamon um attributed
to the FSB and unlike sandworm gamon's
focus is on Espionage data theft and
it's by far the most active AP group in
Ukraine um but they're not not a typical
Espionage group they're very Reckless I
would say they act as if they don't mind
getting caught um they're not really
trying to be stealthy or or anything so
they're using what I'd like to call a a
Brute Force approach they they simply
change their officiation very very
frequently and what they lack in
sophistication they definitely make up
foreign volumes so we detected gamad on
attacks almost every day for the past
couple of years they're basically
Non-Stop
uh there are several ways that uh gamon
infects their targets uh but the main
one is spear fishing campaigns surprise
surprise um their emails are highly
tailored to the targets and they even
send them from compromise accounts of
their victims which increases the chance
of success um they would typically use
HTML smuggling and then the downloaders
uh can then download several possible
payloads um the gamad on Tool Set uh
which we're calling tooto is vast it
consists of a bunch of downloaders
droppers uh weaponizers back door
Steelers and a bunch of other tools even
what you see on this slide is not a full
list I left out the tools that they had
been using in the past but are not using
anymore um and they update these on a
daily
basis in the past couple of months they
significantly uh extended their data
collection capabilities they added some
new tools for stealing data from a
signal t
WhatsApp and from Ukrainian military web
services so the trend here is that while
in the past they were mostly using uh
general purpose Steelers nowadays they
concentrate on The Messengers the web
apps and services that they know their
victims are actually
using so as I mentioned there are tools
set gets updated daily but it's not
about new functionality or at least not
at that frequency um what they are
changing daily is how they offis skate
their code to avoid the protection so
this is just to give you a picture of
what their code off isation looks like
and this is just a small snippet uh
their scripts are typically quite large
and then there are multiple uh stages in
a typical uh gamon execution chain um
the primary targets of this group are uh
Ukrainian government organizations but
at the beginning of this year we also
observed a gamon uh spear fishing
campaign targeting uh institutions in
Poland lvia and
Lithuania so let's wrap up up um there
are many many Russian AP groups in
operation uh much more than we have time
to get into today but and some of them
are very
active uh looking at the trends uh there
have been fewer evident wiper attacks
this year compared to last year but it's
not necessarily for lack of trying um in
the majority of cases we block the
attempts early on and then wiper never
gets a chance to execute which is a good
thing but even if on a smaller scale the
wiper campaign still continue until this
day cyber Espionage is also something
we've been seeing continually over the
years but looking at our Telemetry and
at the rate at which gamon is updating
their tool set we might say that this is
becoming a higher priority and finally
um Ukraine is the prime target of
Russian AP groups it has been that way
for many years but other countries NATO
countries too are being targeted as well
thank you