MITRE ATT&CKsoftware (malware)
S0689 WhisperGate
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.2
- Created
- 2022-03-10
Description
WhisperGate is a multi-stage wiper designed to look like ransomware that has been used against multiple government, non-profit, and information technology organizations in Ukraine since at least January 2022.
Related
Uses · MITRE ATT&CK (28)
- T1685 Disable or Modify Tools technique
- T1680 Local Storage Discovery technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1620 Reflective Code Loading technique
- T1071.001 Web Protocols sub-technique
- T1569.002 Service Execution sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1497.001 System Checks sub-technique
- T1497.003 Time Based Checks sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1561.001 Disk Content Wipe sub-technique
- T1561.002 Disk Structure Wipe sub-technique
- T1134.002 Create Process with Token sub-technique
- T1070.004 File Deletion sub-technique
- T1218.004 InstallUtil sub-technique
- T1055.012 Process Hollowing sub-technique
- T1542.003 Bootkit sub-technique
- T1529 System Shutdown/Reboot technique
- T1485 Data Destruction technique
- T1135 Network Share Discovery technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1036 Masquerading technique
- T1083 File and Directory Discovery technique
- T1102 Web Service technique
- T1105 Ingress Tool Transfer technique
- T1106 Native API technique
Referenced by MITRE ATT&CK · uses (1)
- G1003 Ember Bear group
References
- https://www.cybereason.com/blog/cybereason-vs.-whispergate-wiper Cybereason WhisperGate February 2022
- https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/#whispergate-malware-family Unit 42 WhisperGate January 2022
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ Microsoft WhisperGate January 2022