Mitigations

The authoring agencies recommend organizations implement the mitigations supplied below to improve organizational cybersecurity posture based on threat actor activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s Cross-Sector Cybersecurity Performance Goals for more information on the CPGs, including additional recommended baseline protections.

Limit Adversarial Use of Common Vulnerabilities

• Prioritize patching to CISA’s Known Exploited Vulnerabilities Catalog, especially for CVEs identified in this advisory, and then critical and high vulnerabilities that allow for remote code execution on internet-facing devices.
• Conduct regular automated vulnerability scans to perform vulnerability assessments on all network resources based on threat actor behaviors and known exploitable vulnerabilities (CISA CPG 1.E).
• Limit exploitable services on internet-facing assets, such as email and remote management protocols (CISA CPGs 2.M, 2.W). Where necessary services must be exposed, such as services hosted in a demilitarized zone (DMZ), implement the appropriate compensatory controls to prevent common forms of abuse and exploitation. Disable all unnecessary operating system applications and network protocols to combat adversary enumeration. For additional guidance, see CISA Insights: Remediate Vulnerabilities for Internet-Accessible Systems.
• U.S. organizations can utilize a range of CISA services at no cost, including vulnerability scanning and testing, to help organizations reduce exposure to threats. CISA Cyber Hygiene services can provide additional review of internet-accessible assets and provide regular reports on steps to take to mitigate vulnerabilities. Email vulnerability@cisa.dhs.gov with the subject line, “Requesting Cyber Hygiene Services,” to get started.
• Software manufacturers, vendors, and consumers are encouraged to review CISA and NIST’s Defending Against Supply Chain Attacks. This publication provides an overview of software supply chain risks and recommendations for how software customers and vendors can use the NIST Cyber Supply Chain Risk Management (C-SCRM) Framework and the Secure Software Development Framework (SSDF) to identify, assess, and mitigate software supply chain risks. CISA recommends comprehensive mitigations for supply chain incident reporting, vulnerability disclosing (e.g., security.txt), and choosing a trusted supplier or vendor that observes proper cyber security hygiene (CISA CPG 1.G, 1.H, 1.I) to defend against upstream attacks.

Deploy Protective Controls and Architecture

• Implement network segmentation. Network segmentation can help prevent lateral movement by controlling traffic flows between—and access to—various subnetworks (CISA CPG 2.F). Best practice mitigations include updating Identity and Access Management (IAM) and employing phishing-resistant MFA for all devices and accounts identified as organizational assets. For additional guidance, see CISA and NSA’s IAM Recommended Best Practices Guide for Administrators (CISA CPG 2.H).
• Verify and ensure that sensitive data, including credentials, are not stored in plaintext and can only be accessed by authenticated and authorized users. Credentials must be stored in a secure manner, such as with a credential/password manager to protect from malicious enumeration (CISA CPG 2.L).
• Disable and/or restrict use of command line and PowerShell activity. Update to the latest version and uninstall all earlier PowerShell versions (CISA CPG 2.N).
• Implement a continuous system monitoring program, such as security information and event management (SIEM) or endpoint detection and response (EDR) solutions, to comprehensively log and review all authorized external access connections. This logging will better ensure the prompt detection of misuse or abnormal activity (CISA CPG 2.T).
• Monitor for unauthorized access attempts and programming anomalies through comprehensive logging that is secured from modification, such as limiting permissions and adding redundant remote logging (CISA CPG 2.U). Security appliances should be set to detect and/or block Impacket framework indicators, PSExec or WMI commands, and suspicious PowerShell commands for timely identification and remediation.
• Identify any use of outdated or weak encryption, update these to sufficiently strong algorithms, and consider the implications of post-quantum cryptography (CISA CPG 2.K). Use properly configured and up-to-date Secure Socket Layer (SSL)/Transport Layer Security (TLS) to protect data in transit.

Security Controls

In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

To get started:

1. Select an ATT&CK technique described in this advisory (see Table 3 to Table 14).
2. Align your security technologies against the technique.
3. Test your technologies against the technique.
4. Analyze your detection and prevention technologies’ performance.
5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

Resources

References

1. Microsoft Threat Intelligence Center: Destructive Malware Targeting Ukrainian Organizations
2. Microsoft Threat Intelligence Center: Cadet Blizzard Emerges as a Novel and Distinct Russian Threat Actor
3. CrowdStrike: EMBER BEAR Threat Actor Profile
4. Mandiant Threat Intelligence: Responses to Russia’s Invasion of Ukraine Likely to Spur Retaliation 
5. SentinelOne: Threat Actor UAC-0056 Targeting Ukraine with Fake Translation Software
6. Introduction to Acunetix
7. GitHub: OWASP Amass
8. Kali Linux Tutorials: Droopescan
9. GitHub: OWASP JoomScan
10. Kali.org: MASSCAN
11. DigitalOcean: How To Use Netcat to Establish and Test TCP and UDP Connections
12. Shodan: What is Shodan?
13. VirusTotal: How it Works
14. GitHub: Through the Wire
15. Confluence Security Advisory: Confluence Server and Data Center – CVE-2022-26134
16. Microsoft: Security Bulletin MS17-010
17. Avast: What is EternalBlue and Why is the MS17-010 Exploit Still Relevant?
18. Palo Alto Networks Unit 42: Threat Brief – Ongoing Russia and Ukraine Cyber Activity
19. CERT-UA#3799 Report
20. Bellingcat: Attack on Ukrainian Government Websites Linked to GRU Hackers
21. Trend Micro: Cyberattacks are Prominent in the Russia-Ukraine Conflict

Contact Information

To report suspicious or criminal activity related to information found in this joint Cybersecurity Advisory, contact your local FBI field office or CISA’s 24/7 Operations Center at Report@cisa.gov or (888) 282-0870. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. For NSA client requirements or general cybersecurity inquiries, contact Cybersecurity_Requests@nsa.gov.

Disclaimer

The information in this report is being provided “as is” for informational purposes only. CISA and the authoring agencies do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA and the authoring agencies.

Version History

September 5, 2024: Initial version.

Appendix A: WhisperGate Malware Analysis

Overview

This technical analysis details the WhisperGate malware deployed against Ukraine; samples were collected from one victim and analyzed. The analysis provides insight into Unit 29155 cyber actor infrastructure used for network scanning, password compromising, and data exfiltration against Ukraine, NATO members in Europe and North America, and countries in Latin America and Central Asia.

Unit 29155 cyber actors’ use of WhisperGate involved the deployment of the malware files, stage1.exe and stage2.exe. WhisperGate has two stages that corrupts a system’s master boot record, displays a fake ransomware note, and encrypts files based on certain file extensions (see AA22-057A). The actors used multiple Discord accounts to store malware files, including what appears to be development versions or iterations of the binaries. Discord is commonly leveraged by threat actors as an endpoint for malware distribution and control; in this case, it was used to obtain the next step of the infection chain by directly sharing files through its platform. In the case of stage2.exe, the binary communicated with Discord to obtain Tbopbh.jpg—the malicious payload that is in-memory loaded and performs the destructive capabilities.[18]

Categorization

The Discord accounts associated with the WhisperGate campaign are categorized into three main clusters, labeled below as Clusters 1, 2, and 3. All clusters used Discord as a staging environment for malware deployment. These groupings are based on analysis of threat actor IP addresses and the nature of the malware that existed within the accounts. The following sections include notable details found within each cluster.

Cluster 1

Cluster 1 contained the following files:

• hxxps://cdn.discordapp[.]com/attachments/928503440139771947/930108637681184768/Tbopbh.jpg (a resource, e.g., payload, for stage2.exe)[18]
• saint.exe (a downloader, SaintBot, as detailed by CERT-UA)[19]
• puttyjejfrwu.exe[19]

Cluster 2

Cluster 2 contained:

• hxxps://cdn.discordapp[.]com/attachments/888408190625128461/895633952247799858/n.lashevychdirekcy.atom.gov.ua.zip (means for sending malware in over 35 different zip files via Discord links)[20]
• Several Microsoft Word documents with macros that download test01.exe from 3237.site. Once executed, test01.exe downloads load2022.exe from smm2021.net.

Cluster 3

Cluster 3 contained:

• hxxps://cdn.discordapp[.]com/attachments/945968593030496269/945970446149509130/Client.exe (Note: Unit 29155 cyber actors’ use of Client.exe was confirmed as linked to the activity, but the file was not obtained for analysis and functionality cannot be confirmed.) 
• asd.exe (likely a development version of stage1.exe)

Behavioral Analysis

Two Windows Portable Executable (PE) files (stage1.exe and stage2.exe) were obtained from the Ukrainian victim for analysis. One PE file (asd.exe) was obtained from a U.S. victim.

stage1.exe

stage1.exe was obtained from the C: path of the Ukrainian victim’s Windows machine. stage1.exe executes when the infected device is powered down, overwriting the master boot record (MBR) and preventing the system from booting normally. Table 15 lists the hashes and properties attributed to stage1.exe.

asd.exe is likely a development version of stage1.exe. While the behavior of asd.exe is similar to stage1.exe, the messages displayed were different.

stage2.exe

stage2.exe was obtained from the C: path of the Ukrainian victim’s Windows machine. Table 17 lists the hashes and properties attributed to stage2.exe.