Another Wiper Malware Targeted Enterprises in Ukraine #DoubleZero

Description

FortiGuard Labs is aware that enterprises in Ukraine were targeted by another wiper malware. Dubbed "DoubleZero," the malware was distributed in a zip archive and destroys the compromised machine by overwriting files and deleting registry keys.

Why is this Significant?

This is significant because DoubleZero is the latest wiper malware used in the current Russia-Ukraine war and aims to destroy machines belonging to enterprises in Ukraine.

FortiGuard Labs previous published multiple Threat Signals on other wiper malware that targeted Ukraine. See the Appendix for links to "Additional Wiper Malware Deployed in Ukraine #CaddyWiper," "New Wiper Malware Discovered Targeting Ukrainian Interests" and "Wiper Malware Hit Ukrainian Organizations."

How Widespread is the Malware?

At this time, there is no report that DoubleZero affected organizations outside of Ukraine.

How does DoubleZero Work?

DoubleZero was distributed in several ZIP archives, one of which is called "Virus ... extremely dangerous !!!. Zip." Once DoubleZero runs, it overwrites or uses API calls to zero out non-system files system files before moving on to overwrite critical system files and registry keys.

What is the Status of Coverage?

FortiGuard Labs provides the following AV coverage against the files involved in the attack:

MSIL/DZeroWiper.CK!tr

Appendix

Cyberattack on Ukrainian enterprises using the DoubleZero destructor program (CERT-UA # 4243)

Additional Wiper Malware Deployed in Ukraine #CaddyWiper (Fortinet)

New Wiper Malware Discovered Targeting Ukrainian Interests (Fortinet)

Wiper malware hit Ukrainian organizations (Fortinet)