Cybersecurity incident — 2022-01-13 00:00:00
Affected organization: Undetermined
Affected country: Ukraine
Industry: Finance and Insurance
Event type: Disruptive
Event subtype: Data Attack
Motive: Sabotage
Actor: DEV-0586
Actor type: Nation-State
Actor country: Russian Federation

Microsoft identified a destructive malware (dubbed WhisperGate) operation targeting multiple organizations in Ukraine. This malware first appeared on victim systems in Ukraine on January 13, 2022. The malware is assessed to be designed to look like ransomware but lacking a ransom recovery mechanism and is intended to be destructive rendering targeted devices inoperable rather than to obtain a ransom. Victims span multiple government, non-profit, and information technology organizations. A Ukrainian IT company also confirmed that it found the WhisperGate malware on some of its systems. At least 50 of the 70 sites targeted for defacement were developed and maintained by the said IT company. The latter was compromised, which allowed the hackers to gain access to its' administrator panel and use the company's credentials to deface customer web sites. Microsoft named the samples WhisperGate, while other security companies labeled the downloader as WhisperGate and WhisperKill as the actual wiper, which was considered a component of WhisperGate.