Microsoft Warns of Malware Designed as Ransomware that Deletes User Files

Urian B., Tech Times 18 January 2022, 12:01 am

Microsoft is warning users of a malware that is designed as a ransomware, but is actually deleting the files of its victims. According to the tech giant, the code is designed to render the targeted devices inoperable

As of press time, the full scope of its impact remains unknown.

Microsoft Identified a New Malware Family Called 'Whispergate'

According to the story by Tech.co, Microsoft has just identified a new malware family known as "Whispergate." This malware operates by masquerading as ransomware despite carrying other more destructive actions.

Whispergate, which is actually a malware, hit companies in Ukraine but Microsoft is now admitting that there could also be unidentified victims in other places, which possibly include the United Kingdom and United States.

Infected Victims Given Standard 'Ransomware Note'

Infected victims are given the standard "ransomware note," informs them that their hard drive has been corrupted. The ransom note includes a demand of $10,000 worth of Bitcoin to recover the files. To add, the note is displayed by the MBR or MAster Boot Record, which is the part of the hard drive that instructs the devices on how to load their own operating system.

The method, however, is not usually being used in ransomware attack, which makes Whispergate rather different from the rest. According to MSTIC or the Microsoft Threat Intelligence Center, the malware is usually called "stage1.exe" and is executed through Impacket. Impacket is a collection of different Python classes that is usually used by threat actors for executing certain attacks.

Microsoft Warns that No Ransom Recovery Mechanism Exists

Stage2.exe, however, is another file that is involved in the attacks and works by downloading the malware directly onto the victim's computers. It then identifies files in certain directories, overwrites them, and before eventually renaming them.

Microsoft has noted, however, that there is still no ransom recovery mechanism.

Malware Officially Spotted on January 13, 2022

Aside from targeting system MBRs, MSTIC states that there are also other several features found in the code indicating that it is not your usual ransomware attack. An example of this is demands of ransomware messages are usually very specific to the target

In contrast, the message sent on the recently found malware is just a random payload.

One related feature that is included in the majority of ransomware attacks are custom IDs that the victims are instructed to use when communicating with the attacker. There are, however, no custom IDs featured in the attacks reported.

MSTIC notes that the malware initially appeared in victims' systems on Jan. 13 and that all affected entities that have been identified so far are based in Ukraine.

In yet another post, Microsoft has noted that the attack is actually designed to look like a ransomware but, without the ransom recovery mechanism, it seems like the purpose is really to make targeted devices inoperable instead of getting money out of victims.

This article is owned by Tech Times

Written by Urian B.