IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

'CryWiper' trojan disguises as ransomware, says Kaspersky

The destructive wiper mocks up files as if encrypted, while in reality overwriting all but core system files

A new wiper trojan, disguised as a ransomware payload, has been discovered in the wild by researchers, raising questions about the reason for its existence and the identity of its operators.

CryWiper, named for the distinctive ‘.cry’ extension which it appends onto files, appears on first impression to be a new ransomware strain. Victims’ devices are seemingly encrypted and a ransom note is left demanding money be sent to a bitcoin wallet address. However, the files are actually corrupted beyond recovery.

Related Resource

Getting board-level buy-in for security strategy

Why cyber security needs to be a board-level issue

Intercity 'Getting board-level buy-in for security strategy' whitepaper coverFree Download

Kaspersky researchers laid out findings that prove the malware is actually a wiper that corrupts all but the most critical system files, overwriting each with data produced through a pseudo-random number generator.  

Once on a victim’s system, CryWiper sends the name of the victim’s device to a command and control (C2) server, waiting for an activation command to launch an attack.

This follows a similar methodology to ransomware, with functions performed including the deletion of volume shadow copy to prevent files from being restored and scheduling itself in Windows Task Scheduler to ensure that it restarts every five minutes.

CryWiper also ceases MS SQL, MySQL, MS Active Directory, and MS Exchange services, so that files associated with them are not prevented from being corrupted.

Researchers noted that it disables connection to infected devices through remote desktop protocol (RDP) too, and posited that this is to frustrate the efforts of security teams responding to the incident.

This marks a divergence from typical ransomware behaviour, as payloads generally maintain RDP access in order to facilitate lateral attacks across networks.

A wiper is a malware strain designed to destroy systems indiscriminately, or otherwise cause chaos and destruction on a victim’s device. Wipers have been widely used in Russia’s cyber war against Ukraine, and form part of a malware arsenal that has formed the backbone of the growing threat against critical national infrastructure (CNI).

An email address provided in the ransom text file has been in use since 2017, linking it to several former ransomware families. No conclusive identification has yet been made linking any of the groups.

In a Russian-language blog post unpacking the technical details of the malware, Kaspersky researchers drew further similarities between CryWiper and another wiper observed attacking public infrastructure in Ukraine earlier this year, known as IsaacWiper.

Both wipers use the same pseudo-random generator, ‘Mersenne Vortex’, and are the only two to do so due to the relative complexity of the algorithm compared to other options.

“It’s not common practice, however, deploying destructive payloads that contain ransom notes, with no intention to receive a ransom has been seen before,” said Andy Norton, European cyber risk officer at Armis.

NotPetya is an example of a previous wiper attack. Plausible deniability is one reason to add false flags to malware payloads, another tactic is to invent fictitious threat actor groups, such as the 'Cutting Sword of Justice' again with the reason to deflect attribution of the attack.”

At the time of writing, Kaspersky has only observed targeted CryWiper attacks within the Russian Federation. Given the unknown nature of the group behind CryWiper, as well as the strategic intent of the trojan at this stage, businesses should remain alert to the telltale signs of the payload.

To avoid compromise, Kaspersky recommends close oversight of remote network connections, the use of VPN tunnels for RDP access, as well as strong rather than common passwords, and two-factor authentication (2FA) where possible.

Featured Resources

What 2023 will mean for the industry

What do most IT decision makers really think will be the important trends and challenges in the coming year?

Free Download

2022 Magic quadrant for Security Information and Event Management (SIEM)

SIEM is evolving into a security platform with multiple features and deployment models

Free Download

IDC MarketScape: Worldwide unified endpoint management services

2022 vendor assessment

Free Download

Magic quadrant for application performance monitoring and observability

Enabling continuous updating of diverse & dynamic application environments

View Now

Recommended

GTA V vulnerability exposes PC users to partial remote code execution attacks
vulnerability

GTA V vulnerability exposes PC users to partial remote code execution attacks

23 Jan 2023
MSI to release securer BIOS settings after critical flaw discovered
vulnerability

MSI to release securer BIOS settings after critical flaw discovered

20 Jan 2023
China-backed hackers take down Amnesty International Canada for three weeks
Security

China-backed hackers take down Amnesty International Canada for three weeks

7 Dec 2022
Hyundai vulnerability allowed remote hacking of locks, engine
Security

Hyundai vulnerability allowed remote hacking of locks, engine

30 Nov 2022

Most Popular

Dutch hacker steals data from virtually entire population of Austria
data breaches

Dutch hacker steals data from virtually entire population of Austria

26 Jan 2023
GTA V vulnerability exposes PC users to partial remote code execution attacks
vulnerability

GTA V vulnerability exposes PC users to partial remote code execution attacks

23 Jan 2023
European partners expect growth this year, here are three ways they will achieve it
Sponsored

European partners expect growth this year, here are three ways they will achieve it

17 Jan 2023