With Russian troops refocusing their efforts and combat in Eastern Ukraine intensifying, threat actors continue to target Russian entities in retaliation.

A new strain of ransomware leveraged by threat group NB65 has been targeting Russian entities and is suspectedly built on the source code of Conti ransomware, leaked by a Ukrainian researcher last month.

In opposition, and as a component of their hybrid warfare approach, Russian threat actors have also continued to leverage cyber-attacks against Ukrainian’s critical infrastructure.

On April, 12 the Computer Emergency Response Team of Ukraine (CERT-UA) reported that Russian nation state threat Sandworm attempted attacks against energy facilities by leveraging two destructive malware strains, Industroyer2 and Caddywiper.

Threat group NB65 have continually breached Russian organisations since the initial invasion of Ukraine on February 24, however the leveraging of a novel ransomware strain shows a shift in this group tactics and an expansion to their ‘toolkit’.

Researchers reviewing a sample of the ransomware, posted to VirusTotal, concluded that the group were leveraging a modified Conti executable which was further suspected when NB65 ‘thanked’ Conti in their ransomware note.

Following the invasion, Conti pledged allegiance to Russia, and are known to have worked alongside the Kremlin, therefore the use of their source code by NB65 to launch attacks in retaliation to continue Russian invasion is highly unlikely a coincidence.

In an opposing attack on April 8, APT threat Sandworm attempted to leverage two malware strains, Caddywiper and Industroyer2, to target a Ukrainian energy provider.

Following the response of the CERT-UA against this attack, it was ultimately deemed unsuccessful however, work with ESET researchers provided insight into Sandworm’s suspected attack chain including the discovery of three further malware strains tracked as Orcshred, Soloshred and Awfulshred.

The leveraging of numerous malwares attempted to 34destroy numerous computing systems including Windows, Linux, and Solaris hosts and cause widespread disruption by deeming high-voltage power stations inoperable.

Industroyer2 is suspected to be an upgrade on Industroyer, an infamous piece of malware that was previously leveraged by Sandworm in 2016 to cut power in Ukraine. Crowdstrike have reported that Industroyer2 was compiled as early as March 23, suggesting the group developed Insustroyer2 in a pre-emptive nature of launching attacks in response to ongoing conflict.

By upgrading Industroyer, the group developed the abilities of robust malware to form a more destructive and capable threat, expanding their arsenal.

The deployment of Industroyer2 also falls as multiple waves of wipers have continue targeting various sectors in Ukraine. The continued development of Russian capabilities and APT toolkits suggests that the country’s cyber capability is gaining momentum and cyberwarfare could be leveraged more prominently in coming weeks.

The developing arsenals of groups such as NB65 and Sandworm demonstrates how threat actors continue to adapt their tactics, techniques, and procedures (TTPs) in response to continuing geopolitical events.

Countries in the North Atlantic Treaty Organisation (NATO), including the UK, are continuing to remain vigilant and bolster their defences in preparation of likely disruptive activity, including the attempted deployment of developing ransomware and malware threats, with the goal of eroding political will aligned to the support of Ukraine.

Further guidance from the NCSC on bolstering defences can be reviewed here.

Reporting

Report all Fraud and Cybercrime to Action Fraud by calling 0300 123 2040 or online. Forward suspicious emails to report@phishing.gov.uk. Report SMS scams by forwarding the original message to 7726 (spells SPAM on the keypad).