Hackers Using SwiftSlicer Wiper to Destroy Windows Files, Security Researchers Say

Cybersecurity researchers have identified a new malware that is said to be targeted at Ukraine. The malicious software, spotted by cybersecurity firm ESET, is intended to overwrite files used by Microsoft’s Windows operating system. The security researchers blamed the attack on a group dubbed “Sandworm” that has been repeatedly accused of conducting cyberattacks. The hacking team allegedly deployed a new wiper dubbed SwiftSlicer using Active Directory Group Policy. Once executed, the SwiftSlicer deletes shadow copies, successively overwrites files in the system and non-system drives and then reboots the computer.

Security firm ESET recently discovered a cyberattack that targeted Ukraine. The attack has been attributed to Sandworm and took place on January 25. The team is allegedly one of the hacking groups of Russia’s Main Directorate of the General Staff of the Armed Forces of the Russian Federation (also known as GRU) and is often accused of carrying out cyberattacks. The new malware is written in the Go programming language.

“Attackers deployed a new wiper we named #SwiftSlicer using Active Directory Group Policy. The #SwiftSlicer wiper is written in Go programing language. We attribute this attack to #Sandworm,” ESET revealed via Twitter.

ESET researchers explain that the SwiftSlicer wiper deletes shadow copies on the Windows system after execution. The malware then recursively (successively) overwrites several files located in system drivers as well as non-system drives and then reboots the computer. For overwriting it uses 4096 bytes length block filled with randomly generated bytes, according to ESET.

According to Ukraine’s Computer Emergency Response Team (CERT-UA), Russia’s Sandworm deployed five wiping attacks on the National News Agency of Ukraine – Ukrinform.

In an advisory, CERT-UA states that it discovered CaddyWiper, ZeroWipe, SDelete, AwfulShred, and BidSwipe wiper variants installed on the news agency’s systems. Of these, the first three targeted Windows systems, while AwfulShred and BidSwipe targeted Linux and FreeBSD systems at Ukrinform. The attack was only partially successful and did not affect the operations of the news agency.