Security News > 2023 > May > Russian hackers use WinRAR to wipe Ukraine state agency’s data
The Russian 'Sandworm' hacking group has been linked to an attack on Ukrainian state networks where WinRar was used to destroy data on government devices.
In a new advisory, the Ukrainian Government Computer Emergency Response Team says the Russian hackers used compromised VPN accounts that weren't protected with multi-factor authentication to access critical systems in Ukrainian state networks.
Once they gained access to the network, they employed scripts that wiped files on Windows and Linux machines using the WinRar archiving program.
The archives themselves were then deleted, effectively deleting the data on the device.
CERT-UA says the incident is similar to another destructive attack that hit the Ukrainian state news agency "Ukrinform" in January 2023, also attributed to Sandworm.
As always, VPN accounts that allow access to corporate networks should be protected with multi-factor authentication.
News URL
Related news
- Russian Sandworm hackers targeted 20 critical orgs in Ukraine (source)
- Ukraine claims it hacked Russian Ministry of Defense servers (source)
- Microsoft says Russian hackers breached its systems, accessed source code (source)
- Microsoft Confirms Russian Hackers Stole Source Code, Some Customer Secrets (source)
- Microsoft: Russian hackers accessed internal systems, code repositories (source)
- Ukraine arrests hackers trying to sell 100 million stolen accounts (source)
- Russian Hackers May Have Targeted Ukrainian Telecoms with Upgraded 'AcidPour' Malware (source)
- Russian hackers target German political parties with WineLoader malware (source)
- Russian Hackers Use 'WINELOADER' Malware to Target German Political Parties (source)
- Russian Sandworm hackers pose as hacktivists in water utility breaches (source)