urlscan.io logo urlscan.io
SecurityTrails logo

www.sentinelone.com Open in urlscan Pro
172.67.74.101  Public Scan

Back to summary
URL: https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
Submission: On February 25 via manual from FR — Scanned from FR

Form analysis 6 forms found in the DOM

GET https://www.sentinelone.com

<form autocomplete="off" method="get" action="https://www.sentinelone.com">
  <fieldset>
    <input type="search" name="s" placeholder="Search ..." value="">
    <button class="search" type="submit">
      <span class="light">
        <img class="icon-search" src="https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg">
        <img class="icon-down" src="https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg">
      </span>
      <span class="dark">
        <img class="icon-search" src="https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg">
        <img class="icon-down" src="https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg">
      </span>
    </button>
  </fieldset>
</form>

GET https://www.sentinelone.com/

<form role="search" method="get" class="search-form" action="https://www.sentinelone.com/">
  <label>
    <span class="screen-reader-text">Search ...</span>
    <input type="search" class="search-field" placeholder="Search ..." value="" name="s">
  </label>
  <input type="submit" class="search-submit" value="Search">
</form>

<form id="mktoForm_1985" novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft bf_form_init" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); width: 1601px;" bf_offer_id="1467789052">
  <style type="text/css"></style>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Email" id="LblEmail" class="mktoLabel mktoHasWidth" style="width: 0px;">
          <div class="mktoAsterix">*</div>
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" placeholder="Business Email" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
          class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Employees__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Industry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="AnnualRevenue" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Address" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="City" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="PostalCode" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="SIC_Code2__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Website" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseSID" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Phone" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseCompany" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseCountry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseState" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseEmployeeRange" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="subIndustry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="dataSource" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListAccountType" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListAccountOwner" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListAccountStatus" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListCampaignCode" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">Subscribe</button></span></div>
  <div class="marketo-legal">By clicking Subscribe, I agree to the use of my personal data in accordance with SentinelOne <a href="/legal/privacy-policy/">Privacy Policy</a>. SentinelOne will not sell, trade, lease, or rent your personal data to
    third parties.</div><input type="hidden" name="formid" class="mktoField mktoFieldDescriptor" value="1985"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="327-MNM-087">
</form>

<form id="mktoForm_2673" novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft bf_form_init" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); width: 1601px;" bf_offer_id="1467762177">
  <style type="text/css"></style>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Email" id="LblEmail" class="mktoLabel mktoHasWidth" style="width: 0px;">
          <div class="mktoAsterix">*</div>
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" placeholder="Business Email" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
          class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Employees__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Industry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="AnnualRevenue" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Address" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="City" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="PostalCode" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="SIC_Code2__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Website" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseSID" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Phone" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseCompany" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseCountry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseState" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseEmployeeRange" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="subIndustry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="dataSource" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListAccountType" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListAccountOwner" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListAccountStatus" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListCampaignCode" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">Subscribe</button></span></div>
  <div class="marketo-legal">By clicking Subscribe, I agree to the use of my personal data in accordance with SentinelOne <a href="/legal/privacy-policy/">Privacy Policy</a>. SentinelOne will not sell, trade, lease, or rent your personal data to
    third parties.</div><input type="hidden" name="formid" class="mktoField mktoFieldDescriptor" value="2673"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="327-MNM-087">
</form>

<form novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;"></form>

<form novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;"></form>

Text Content

 * 
 * 


 * ABOUT
 * CONTACT
 * VISIT SENTINELONE.COM


Back
 * ABOUT
 * CONTACT
 * VISIT SENTINELONE.COM


Advanced Persistent Threat


HERMETICWIPER | NEW DESTRUCTIVE MALWARE USED IN CYBER ATTACKS ON UKRAINE

Juan Andrés Guerrero-Saade / February 23, 2022


EXECUTIVE SUMMARY

 * On February 23rd, the threat intelligence community began observing a new
   wiper malware sample circulating in Ukrainian organizations.
 * Our analysis shows a signed driver is being used to deploy a wiper that
   targets Windows devices, manipulating the MBR resulting in subsequent boot
   failure.
 * This blog includes the technical details of the wiper, dubbed HermeticWiper,
   and includes IOCs to allow organizations to stay protected from this attack.
 * This sample is actively being used against Ukrainian organizations, and this
   blog will be updated as more information becomes available.
 * SentinelOne customers are protected from this threat, no action is needed.


BACKGROUND

On February 23rd, our friends at Symantec and ESET research tweeted hashes
associated with a wiper attack in Ukraine, including one which is not publicly
available as of this writing.



We started analyzing this new wiper malware, calling it ‘HermeticWiper’ in
reference to the digital certificate used to sign the sample. The digital
certificate is issued under the company name ‘Hermetica Digital Ltd’ and valid
as of April 2021. At this time, we haven’t seen any legitimate files signed with
this certificate. It’s possible that the attackers used a shell company or
appropriated a defunct company to issue this digital certificate.

HermeticWiper Digital Signature

This is an early effort to analyze the first available sample of HermeticWiper.
We recognize that the situation on the ground in Ukraine is evolving rapidly and
hope that we can contribute our small part to the collective analysis effort.


TECHNICAL ANALYSIS

At first glance, HermeticWiper appears to be a custom-written application with
very few standard functions. The malware sample is 114KBs in size and roughly
70% of that is composed of resources. The developers are using a tried and
tested technique of wiper malware, abusing a benign partition management driver,
in order to carry out the more damaging components of their attacks. Both the
Lazarus Group (Destover) and APT33 (Shamoon) took advantage of Eldos Rawdisk in
order to get direct userland access to the filesystem without calling Windows
APIs. HermeticWiper uses a similar technique by abusing a different driver,
empntdrv.sys.

HermeticWiper resources containing EaseUS Partition Manager drivers

The copies of the driver are ms-compressed resources. The malware deploys one of
these depending on the OS version, bitness, and SysWow64 redirection.

EaseUS driver resource selection

The benign EaseUS driver is abused to do a fair share of the heavy-lifting when
it comes to accessing Physical Drives directly as well as getting partition
information. This adds to the difficulty of analyzing HermeticWiper, as a lot of
functionality is deferred to DeviceIoControl calls with specific IOCTLs.


MBR AND PARTITION CORRUPTION

HermeticWiper enumerates a range of Physical Drives multiple times, from 0-100.
For each Physical Drive, the \\.\EPMNTDRV\ device is called for a device number.



The malware then focuses on corrupting the first 512 bytes, the Master Boot
Record (MBR) for every Physical Drive. While that should be enough for the
device not to boot again, HermeticWiper proceeds to enumerate the partitions for
all possible drives.

They then differentiate between FAT and NTFS partitions. In the case of a FAT
partition, the malware calls the same ‘bit fiddler’ to corrupt the partition.
For NTFS, the HermeticWiper parses the Master File Table before calling this
same bit fiddling function again.

MFT parsing and bit fiddling calls

We euphemistically refer to the bit fiddling function in the interest of
brevity. Looking through it, we see calls to Windows APIs to acquire a
cryptographic context provider and generate random bytes. It’s likely this is
being used for an inlined crypto implementation and byte overwriting, but the
mechanism isn’t entirely clear at this time.

Further functionality refers to interesting MFT fields ($bitmap, $logfile) and
NTFS streams ($DATA, $I30, $INDEX_ALLOCATION). The malware also enumerates
common folders (‘My Documents’, ‘Desktop’, ‘AppData’), makes references to the
registry (‘ntuser’), and Windows Event Logs
("\\\\?\\C:\\Windows\\System32\\winevt\\Logs"). Our analysis is ongoing to
determine how this functionality is being used, but it is clear that having
already corrupted the MBR and partitions for all drives, the victim system
should be inoperable by this point of the execution.

Along the way, HermeticWiper’s more mundane operations provide us with further
IOCs to monitor for. These include the momentary creation of the abused driver
as well as a system service. It also modifies several registry keys, including
setting the SYSTEM\CurrentControlSet\Control\CrashControl CrashDumpEnabled key
to 0, effectively disabling crash dumps before the abused driver’s execution
starts.

Disabling CrashDumps via the registry

Finally, the malware waits on sleeping threads before initiating a system
shutdown, finalizing the malware’s devastating effect.


CONCLUSION

After a week of defacements and increasing DDoS attacks, the proliferation of
sabotage operations through wiper malware is an expected and regrettable
escalation. At this time, we have a very small sliver of aperture into the
attacks in Ukraine and subsequent spillover into neighboring countries and
allies. If there’s a silver lining to such a difficult situation, it’s seeing
the open collaboration between threat intel research teams, independent
researchers, and journalists looking to get the story straight. Our thanks to
the researchers at Symantec, ESET, Stairwell, and RedCanary among others who’ve
contributed samples, time, and expertise.


SENTINELONE CUSTOMERS PROTECTED




INDICATORS OF COMPROMISE

HermeticWiper SHA1 Win32 EXE 912342f1c840a42f6b74132f8a7c4ffe7d40fb77 Win32 EXE
61b25d11392172e587d8da3045812a66c3385451

ms-compressed SHA1 RCDATA_DRV_X64 a952e288a1ead66490b3275a807f52e5
RCDATA_DRV_X86 231b3385ac17e41c5bb1b1fcb59599c4 RCDATA_DRV_XP_X64
095a1678021b034903c85dd5acb447ad RCDATA_DRV_XP_X86
eb845b7a16ed82bd248e395d9852f467

rule MAL_HERMETIC_WIPER {
    meta:
      desc = "HermeticWiper - broad hunting rule"
      author = "Friends @ SentinelLabs"
      version = "1.0"
      last_modified = "02.23.2022"
      hash = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
    strings:
        $string1 = "DRV_XP_X64" wide ascii nocase
        $string2 = "EPMNTDRV\\%u" wide ascii nocase
        $string3 = "PhysicalDrive%u" wide ascii nocase
        $cert1 = "Hermetica Digital Ltd" wide ascii nocase
    condition:
      uint16(0) == 0x5A4D and
      all of them
}


Ukraine
wiper


SHARE



JUAN ANDRÉS GUERRERO-SAADE

Juan Andrés is a Principal Threat Researcher at SentinelOne and an Adjunct
Professor of Strategic Studies at Johns Hopkins School of Advanced International
Studies (SAIS). Juan Andrés was Chronicle Security’s Research Tsar, founding
researcher of the Uppercase team. Prior to joining Chronicle, he was Principal
Security Researcher at Kaspersky’s GReAT team focusing on targeted attacks and
worked as Senior Cybersecurity and National Security Advisor to the Government
of Ecuador. His joint work on Moonlight Maze is now featured in the
International Spy Museum’s permanent exhibit in Washington, DC.

Prev

SANCTIONS BE DAMNED | FROM DRIDEX TO MACAW, THE EVOLUTION OF EVIL CORP


RELATED POSTS


HACKTIVISM AND STATE-SPONSORED KNOCK-OFFS | ATTRIBUTING DECEPTIVE HACK-AND-LEAK
OPERATIONS

January 27 2022


WADING THROUGH MUDDY WATERS | RECENT ACTIVITY OF AN IRANIAN STATE-SPONSORED
THREAT ACTOR

January 12 2022


EGOMANIAC | AN UNSCRUPULOUS TURKISH-NEXUS THREAT ACTOR

September 08 2021


SEARCH

Search ...


AMAZON POLLY


SIGN UP

Get notified when we post new content.

*
























Subscribe
By clicking Subscribe, I agree to the use of my personal data in accordance with
SentinelOne Privacy Policy. SentinelOne will not sell, trade, lease, or rent
your personal data to third parties.

Thanks! Keep an eye out for new content!


RECENT POSTS

 * Sanctions Be Damned | From Dridex to Macaw, The Evolution of Evil Corp
   February 23, 2022
 * Log4j2 In The Wild | Iranian-Aligned Threat Actor “TunnelVision” Actively
   Exploiting VMware Horizon
   February 17, 2022
 * ModifiedElephant APT and a Decade of Fabricating Evidence
   February 9, 2022


LABS CATEGORIES

 * Crimeware
 * Security Research
 * Security & Intelligence
 * Advanced Persistent Threat
 * Adversary


SENTINELLABS

In the era of interconnectivity, when markets, geographies, and jurisdictions
merge in the melting pot of the digital domain, the perils of the threat
ecosystem become unparalleled. Crimeware families achieve an unparalleled level
of technical sophistication, APT groups are competing in fully-fledged cyber
warfare, while once decentralized and scattered threat actors are forming
adamant alliances of operating as elite corporate espionage teams.


LATEST TWEET

 * YARA rules to detect live ongoing attacks against Ukraine, by @TomHegel from
   SentinelLabs #HermeticWiper #Wiper… https://t.co/Uvgzz3H1B015 hours ago
 * RT @jfslowik: #CTI #HermeticWiper #CyclopsBlink https://t.co/1PPVM8hKPc13
   hours ago
 * RT @elinormills: Second Wiper Attack Strikes Systems in Ukraine and Two
   Neighboring Countries https://t.co/jPAroMw6WU By @KimZetter feat @s…14 hours
   ago
 * RT @silascutler: If you're looking at #Golang binaries in IDA @SentinelOne's
   https://t.co/Coq2UA4D2o is by far one of the most useful tools…14 hours ago
 * YARA rules to detect live ongoing attacks against Ukraine, by @TomHegel from
   SentinelLabs #HermeticWiper #Wiper… https://t.co/Uvgzz3H1B015 hours ago
 * RT @jfslowik: #CTI #HermeticWiper #CyclopsBlink https://t.co/1PPVM8hKPc13
   hours ago




RECENT POSTS

 * Sanctions Be Damned | From Dridex to Macaw, The Evolution of Evil Corp
   February 23, 2022
 * Log4j2 In The Wild | Iranian-Aligned Threat Actor “TunnelVision” Actively
   Exploiting VMware Horizon
   February 17, 2022
 * ModifiedElephant APT and a Decade of Fabricating Evidence
   February 9, 2022


SIGN UP

Get notified when we post new content.

*
























Subscribe
By clicking Subscribe, I agree to the use of my personal data in accordance with
SentinelOne Privacy Policy. SentinelOne will not sell, trade, lease, or rent
your personal data to third parties.

Thanks! Keep an eye out for new content!

 * Twitter
 * LinkedIn

©2022 SentinelOne, All Rights Reserved.









PRIVACY PREFERENCE CENTER

When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information
Allow All


MANAGE CONSENT PREFERENCES

FUNCTIONAL COOKIES

Functional Cookies

These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then some
or all of these services may not function properly.

STRICTLY NECESSARY COOKIES

Always Active

These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to block
or alert you about these cookies, but some parts of the site will not then work.
These cookies do not store any personally identifiable information.

PERFORMANCE COOKIES

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.

TARGETING COOKIES

Targeting Cookies

These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.

Back Button Back



Vendor Search Search Icon
Filter Icon

Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

Confirm My Choices


By clicking “Accept All Cookies”, you agree to the storing of cookies on your
device to enhance site navigation, analyze site usage, and assist in our
marketing efforts.

Cookies Settings Accept All Cookies



We'd like to show you notifications for the latest news and updates.


AllowCancel