An Analysis of Russian Cyber Attacks On Ukraine

In this video I look over some of Russia's cyber weapons and state sponsored hacking attacks that are taking place against Ukraine. This includes an analysis of Russian malware like FoxBlade (HermeticWiper), Lasainraw (IsaacWiper) DesertBlade, FiberLake, SonicVote CaddyWiper and Industroyer2.
Full writeup from Microsoft and Malwarebytes
query.prod.cms.rt.microsoft.c...
blog.malwarebytes.com/threat-...
₿💰💵💲Help Support the Channel by Donating Crypto💲💵💰₿
Monero
45F2bNHVcRzXVBsvZ5giyvKGAgm6LFhMsjUUVPTEtdgJJ5SNyxzSNUmFSBR5qCCWLpjiUjYMkmZoX9b3cChNjvxR7kvh436
Bitcoin
3MMKHXPQrGHEsmdHaAGD59FWhKFGeUsAxV
Ethereum
0xeA4DA3F9BAb091Eb86921CA6E41712438f4E5079
Litecoin
MBfrxLJMuw26hbVi2MjCVDFkkExz8rYvUF
Dash
Xh9PXPEy5RoLJgFDGYCDjrbXdjshMaYerz
Zcash
t1aWtU5SBpxuUWBSwDKy4gTkT2T1ZwtFvrr
Chainlink
0x0f7f21D267d2C9dbae17fd8c20012eFEA3678F14
Bitcoin Cash
qz2st00dtu9e79zrq5wshsgaxsjw299n7c69th8ryp
Etherum Classic
0xeA641e59913960f578ad39A6B4d02051A5556BfC
USD Coin
0x0B045f743A693b225630862a3464B52fefE79FdB
Subscribe to my KZbin channel goo.gl/9U10Wz
and be sure to click that notification bell so you know when new videos are released.

[@ginx2666]

A software that purposefully causes fragmentation would be a fragmenting bot, so a "fraggot".

[@UrbExGear]

Fragger, Fragramator

[@Smokkedandslammed]

We don't take too kindly to fraggots round here. They said yo daddy was a fragger back in his day and that's why he ain't around no more!

[@adzbadz8349]

Lmfao

[@calvinvastelli6792]

I've never heard of a fraggot before. It seems like these things are slowly coming out of the closet and making use of a hard drive to fook the internal parts of our systems.

[@Bagginsess]

I thought we already had a word for small little things that catch fire?

[@sulphurous2656]

Those tractors that were remotely disabled is some really scary stuff that we can expect to be dealing with as everything we use in our life becomes tied to electronics.

[@mahirdeth]

tractors stole ruski tanks and ruskies disabled em

[@andybunn5780]

But those chips need to be there so you can’t repair your tractor on your own

[@manitoba-op4jx]

@we did it bot

[@chavaspada]

They are used against the consumer already. Louis Rossman has talked about it in his right to repair videos.

[@DyoKasparov]

We live in Watch Dogs universe

[@saddlepiggy]

credit to cybersecurity professionals for giving hacking tools and malware such dope names

[@tfwmemedumpster]

Expecting an attack to cause long term disruption is unrealistic. Attacks should be coordinated between online and offline. You blackout a city and then immediately move in, who cares if it goes back online the day after, you already took control of it physically.

[@WorriedTheif]

That would actually be a pretty good idea.

[@quincyames2014]

or attack the economy

[@Tarik360]

You literally just explained combined arms warfare but with cyber attacks as a bonus.

[@simeonsimon6440]

You need to continually oppress a population. It's not like most people just roll over and accept a hostile takeover. Most communications would be taken out for months to prevent retaliation.

[@svampebob007]

honestly after working in massive organizations for close to two decades (not in IT, but still interested in IT), "well shit the computers are off again, well it's back to paper, sooner or later the computer are going back online, and you sir will get charged :)" It fucking sucks, but even with the last attack during week 1 where everything was down, there was enough contingency to keep everything rolling. Every single transactions was store offline, even though our servers were compromised, our ISP was compromised, and our bank was compromised, our terminals were compromised, it took the poor IT staff of all those companies 7 whole days to get back to 100% normal and the cost was: "please sign here", and we kept the receipt in case the government wants to audit us. in total around 10 computers were infected to some degrees, and one data center was compromised, to some extent, the 7 day shut down was a result of them not wanting to start opening as normal too early and also figuring out what exactly caused the infection.

[@alexnone5720]

My work computer is pretty well locked down by IT. I cannot even write to the C drive, read access there only. Getting non-standard software installed takes a request form then IT can log in remotely to enter their admin privileges to run the install. If an install or update is critical to work delivery then I've seen it done in as little as a few hours so productivity is hardly an excuse not to give everybody admin rights. If we don't bother IT dept it is usually 2-4 days for the request to work its way through the system. In a lot of ways I like having the work computer locked down so well because it will usually prevent the situation of a manger saying "just get it done, move the file on a USB, install this other software" or whatever else that is a company policy violation and "my manger told me to" is not an excuse if you get caught doing stuff like that. Instead, we get to say things like "I'd wish I could do that but I don't have admin rights..... "

[@PixelPhobiac]

I'd quit. For sure

[@mblend27]

Yes - that’s not a computer - it’s a tool

[@alexnone5720]

@@PixelPhobiac Why? It is a company issued computer that can access sensitive company data. Every workstation is a potential security hole and the large majority of employees do not need any software beyond what is provided when the computer is issued.

[@facemonkeys]

Missed a perfect chance to say, “War. War never changes.”

[@facemonkeys]

@@cobrazoid brb gotta go feed Rex

[@commentaccount7880]

@@cobrazoid he'll say that when the nukes drop, can't wait for a tips video on keeping electronics safe from radiation

[@DuncanMcBride]

War. Has changed. Metal Gear>Fallout

[@0p10ids7]

good. its cringe and overdone.

[@ytuser0110]

Because war does change, in this case you can see it unfold.

[@ReviloYaj]

"make sure you're keeping your computer updated": shows screen of not updating since 2017

[@abrvalg321]

5:00 there is no need for specific software. NTFS does a good job of creating fragments on its own.

[@Ultrajamz]

I hope our glowies are doing their jobs and protecting our backbone against this instead of constantly trying to encourage useful idiots on forums

[@SFTaYZa]

I'm sure they're working hard to "help".

[@tuanpham-ph6fv]

Lol, imagine expecting the glowies to do anything other than fucking you over

[@lol-dm8wx]

i mean 4ch and 8ch are cesspits that have no reason to exist

[@fort809]

They definitely are, massive cyberattacks would erode trust in the government and then the sheep would start getting ideas

[@JordanPlayz158]

"What do you think a software that deliberately causes fragmentation should be called?" Windows :)

[@SithlordSigma]

Not gonna lie, was expecting a "War.. War never changes" from you at the start of the video lol Felt like bait and switch tier writing imo which is amazing.

[@Lupinicus1664]

Scanning AVs are, as you rightly say, an ever diminishing part of overall cyber defence. Behavioural systems e.g Cybereason, Crowdstrike, CarbonBlack etc. plus a suitably staffed SOC should be in place for any/all CNI targets. Good video as always.

[@SurrogateActivities]

Way more professional than whatever "anonymous" was doing

[@lukesutton4135]

Anonymous pre CIA or CIA "anon"? As there is an exceptionally distinct difference to anyone who ever cares to pay attention.

[@skeiter7]

@@lukesutton4135 whats the difference?

[@fort809]

@@skeiter7 Anonymous are glowies

[@kevinok8021]

​@@skeiter7 one was a group of people other was a fake encrypted phone sold by the cia

[@rodiculous9464]

Liberal script kiddies from Cali vs a nation-state actor hmmm that's a tough one

[@isbestlizard]

Oh my god the windows ecosystem is so infested with malware you have to triple wrap your antivirus to stay safe versus just raw dogging it with linux o.o

[@Anti-FreedomD.P.R.ofSouthKorea]

Enterprise-level antivirus with data leakage coverage*

[@Sir.suspicious]

Even here in Portugal, some days ago someone hacked into the hospitals servers

[@bandvitromania9642]

Some hacks where also reported on some Romanian news websites and other things

[@tubbiele2]

Well done!

[@Leroy0070]

Thank you for your story mate.

[@Bockanator]

Hey, I think it could be interesting to see you review some antivirus (specifically for windows but linux could be cool) and compare them. Great video btw!

[@LiborTinka]

I wonder where the stereotypical "hacker" (i.e. guy with black hoodie in a dark room) came from - this was typical for drug dealers so maybe it transited to computer hacking via the dark web phenomenon. Anyway I find the stereotype amusing since I believe very little people are actually like that :D

[@ticklemaster6257]

Keep this stuff coming, king. You're doing the lords work

[@may_god_save_us]

Thanks, nice video

[@OcteractSG]

If you want to wipe a drive that you're done with, you could install encrypted Debian to it and make sure to overwrite the entire drive. Nothing wrong with a clean, untouched Debian installation.

[@zdrojneuveden]

or just use dd if=/dev/urandom of=/path/to/the/drive

[@wojcieszekk8581]

Hey, idk if you talked about it but it would be great to hear more about hacking Linux by the Russians. Anyways great video as always keep it up my man 👊 😎

[@ivanichianus5227]

Indeed, I would love to see some of the hidden gems that Russians have for the linux kernel.

[@windowsxseven]

@we did it GUYS IT'S HEREEEE

[@danni222]

@@mythbuster6126 oy vey!

[@xanixanixani]

recent bios update and your vid pushed me on thought,that there might be a malware that rewrites bios to shit,thus making a motherboard unusable until repairment,also this can be combined with wiping data,which makes a horrible combination i hope i didnt made much grammar mistakes

[@1337dun]

бро рм рфнись

[@xanixanixani]

@@1337dun что

[@alexandriat5929]

The interesting part of those scanners that picked this up was they seemed ready. Also those in my experience are the worse anti virus protection .. I uninstall McAfee, it's garbage. If you don't like buying 3 scanners praying they work is a bad deal, don't run windows if you don't want these issues, it's the design of the system architecture and terrible code and lazy developers who cause things like this. For god sake the bugs have been so bad, development and maintenance so slow the nsa had to fix the bugs for national security .. I know taxpayers paid that. Why is public tax dollars to support a greasy private corporation that is unethical and bad at their job ? Gold plated contracts. Run Linux, learn layered security hardening skills and gain skill in identifying bad software. Bad software won't let you view the code, black hats have no fucks to give about laws..Security through obscurity is a myth and fails. Mx Linux is excellent end user os.. I am 7 minutes into watching ..

[@AntiWanted]

Nice

[@AbdulHannanAbdulMatheen]

👏😐 very interesting

[@Darki0n]

A program that causes fragmentation should be labeled as a fragmentation propagator as it propagates fragmentation across the disk.

[@vortigan9068]

this is a legendary topic for me. like just imagin the pentagon going down because they got ddosed with pornography

[@vortigan9068]

ignore the other guy. but never forget Johnny Sins the infamous russian espionage agent.

[@TheGrinningViking]

America's local Anon did take down their website right before disappearing for fiveish years and coming back repeating American talking points. They flew too close to the sun.

[@christopherneufelt8971]

They called it shuffler. It fragments the data. That is how my data were messed up. At least I found the name of the malware. As for my data...tears on my eyes.

[@rodiculous9464]

How would you refrag an SSD? Are they using HDD still?

[@mrhappysmiley2968]

This sounds like a video essay for a class

[@Embassy_of_Jupiter]

How should I control my nuclear reactor from the app when I don't connect it to the internet? I have to log into my Nukulr account to put in the control rods after all, duh

[@CrittingOut]

Duhh

[@petyavodolaz]

I wonder if Kaspersky antivirus will detect them :D

[@TheDrunkenGunsmith]

7:08 AYO MISTA CLEAN DRILLIN THAT GIGGLE SWITCH

[@chubbycatfish4573]

So Russia sucks at hacking, too.

[@abhabh6896]

according to Microsoft

[@jameshughes3014]

what is software that purposefully fragments the hard drive called? easy.. microsoft windows.

[@noanyobiseniss7462]

Did it get picked up by Kaspersky?

[@JonathanZigler]

War, war never changes.

[@seventhgreeter5416]

wait, so secure delete is essentially just sudo shred -uz ?

[@tailsorange2872]

0:21 Arch Force (You know, because Arch Linux's brand icon looks similar....)

[@rickybhattacharya6]

4:44 Kenny, I wonder if Microsoft's own antivirus software -- Microsoft/Windows Defender is that big a malware.

[@antipoti]

14:00 Hmm, sounds familiar. I once had to wait a week just to install notepad++...

[@PinakiGupta82Appu]

I always keep Remote Desktop disabled. It doesn't always work. Windows is Windows because Bill will maintain his legacy.

[@markusTegelane]

Software that purposefully fragments data is just a "fragmenter"

[@rtg5881]

12:30 John Deere. They appearently can shut down tractors remotely. Nothing bad could come from tractors not working, eh?

[@unrealtinec2398]

What OS do goverments use? That's a genuine question I have. I assume it's linux. But how exactly do they manage to hack them? Sorry Im not very literate in cyber security and stuff

[@threestans9096]

us govt pays microsoft for cust serv and updates i think, for XP because so much is run off it.

[@wilux2469]

Userwise: Windows everywhere that i've seen, except maybe some very high security stuff? Serverwise: Windows Xp and an unpatched Java 8 apache server (totally not speaking from experience here)

[@vincentschumann937]

windows (seen as old as win2k on a gov box)

[@pisslord4150]

windows 7.

[@unrealtinec2398]

@@threestans9096 As far as I am aware, linux in general is much more secure. So why would they pay microsoft when they could hire some it guys and let them develop a secure custom linux distro designed for goverment purposes? Or would it still be open to cyberattacks regardless of the OS used?

[@Din0za]

37 destructive incidents, this is probably more than half of all Ukrainian security devices...

[@Embassy_of_Jupiter]

They are disabling government functions? I thought hackers were supposed to do bad things

[@ReptilianLepton]

Based.

[@marblepants]

not a good look when said government is de facto the biggest protector against immediate violence huh

[@cbtillery135]

War. War never changes.

Software the purposely fragment data on drives should be called: A Feature.

[@lucymorrison]

0:00 War. War never changes.

[@gruanger]

refrager = scrambler = pointer jumbler = address maze, anything anyone can come up with.

[@samyt681]

Would be a shame if I lost my 2TB of lolis

[@coompiler9029]

I installed Linux and the feeling of freedom and privacy hit me so hard that I immediately began committing crimes, knowing that the FBI could never track me. Piracy, sexual assault, trademark infringement, petty larceny, tax fraud, you name it. I also own several fully automatic firearms even though I live in the state of California, but it doesn't matter. Ever since I removed Windows 10 from my computer and replaced it with Arch Linux, and began using a PinePhone as my daily driver phone, police can't even stop me in traffic. Windows may have a lot of video games, but the benefits of Linux should not be understated.

[@samyt681]

@@coompiler9029 based and copy & paste maxxed enjoyer

[@burnv06]

Sus 🤨

[@ejonesss]

couldnt. 1. a disk equiv of out of bounds write be used to write over the disk? 2. user level software take control of the read write head and force write in the same way that bad blocks can be crafted on cds to lock the laser in the laser lock copy protection? 3. brute force overwrite by zeroing out sector 1 then go to 2 and so on until the end of the disk. of course the best way would be to start from the end and work the way to the beginning since deleting the sectors 0 and 1 witch is where the boot sectors are would make it very obvious the idea would be to have wiped the other data first so by the time the machine is no longer able to boot it is too late. probably why golang is less effective is it just like rust does not have the low level access to the system natively heck you may not be able to write a entire operating system in golang or rust. not to be confused with the movie/tv series where the gun incident happened. actually it is possible to perfect the malware to be on it's own and wipe the domain controls so the victim cant update. i have seen other videos show that data can be transfered over the airgap via the emf given off from the parts, the subtle variation of the sound of the fans running, changes in the modulation of the electric in the power supply and such.

[@adud6764]

How about "Fragmenter"?

[@TiberianFiend]

Is Mr. Clean modifying an AR-15?

[@rawrizord]

Based

[@ano1nymus1]

A program that causes file system fragmentation? How about NTFS.SYS

[@ReptilianLepton]

kek

[@VioletPrism]

Hehe

[@bigjohn2811]

A refragger is what happens when a fragger hard drive goes through conversion therapy, but then converts back to being a fragger.

[@Daimo83]

Mmm sweet microsoft windows telemetry data.

[@PollHard]

What pdf software he using? The first minute

[@redimperator2527]

the graphics on this were such a good shitpost, bravo good sir

[@madcat789]

A program that causes fragmentation? Call it a Fragmentor.

[@Gurj101]

software purposely causing fragmentation should be called : Frag Grenade 😂

[@Ghfvhvfg]

Digital Frag grenade that’s a good name

[@hkhjg1734]

how did this get ran on systems? like how do these get from a Russian hackers PC onto the Ukrainian systems and deployed all at once?

[@愛]

Nights video, John

[@John-zs8jg]

out of curiosity, what if someone were to run the virus on Linux using something like wine lol.

[@damjanivanovic5759]

Microsoft Ukraine Report? Microsoft? Really?

[@ddenobrega8298]

I'm way early today

[@DECHEFKING1]

14:05 in my company you need IT to install new software. But we are a wholesaling company and really dont need any other programs than what we got and what is whitelisted.

[@arturm4558]

Best practice is to only use approved software, and the should be enforced by allow listing trusted software. And if you want to be nice, you allowlist Spotify, Netflix or whatever. But software needs to be vetted before being allowed on a system. Now even more than ever. If it more work? No. Higher initial setup? Yup. Long term? A lot less risk. So cheaper.

[@lemdixon01]

Unfragger or just fragger ?

[@lordvalen8133]

I would just call it a fragger.

[@antoniobaric5798]

I expected "War.. War never changes." when you started. Nevertheless, I m not dissapointed since you re doing my coorporate overlords a favor with all this info.

[@ShizaruBloodrayne]

Technically just being on the internet or using devices or buying anything is benefiting the corporate overlords lol

[@germanshepherd6638]

Do a video on stuxnet !

[@Verinenkorppi]

I'd call mine 'Frag Grenade'

[@keypo790]

you just Saved my ass to this day

[@ince55ant]

i think refragorator sounds cool

[@Ghfvhvfg]

If you the devil

[@big.atom37]

Wasn't there a massive attack on Ukrainian military's satellite communications infrastructure as well?

[@rtg5881]

Not diminished? Its the opposite in fact. In a monarchy war tends to be a lot less total, its not all that concerning, us as peasants dont care if the kings fight over who really inherited this piece of land in their complex structure of intermarriage. We wouldnt be barred from traveling between the "warring nations" nor drafted. For the most part, anyways, it was a personal affair of the person waging the war. Yes, monarchy is a lot less bad than democracy in so many regards.

[@vitolapinta]

"War. War ever changes." -Fallout 69

[@comradesusiwolf1599]

war, has changed.

[@A54729]

First Also I really appreciate the video. This is serious stuff and I have been talking with my friends about preparedness, in part because of the vulnerability of critical infrastructure to cyber attacks.

[@Bagginsess]

Ever wonder if Chernobyl was proto-stuxnet? >baka

[@ginx2666]

Nah, that's just typical communist fuckup, nothing good comes from that system.

[@ReptilianLepton]

Ah yes, how sneaky of us devious Westoids to give Soviet nuclear engineers the winning idea of putting neutron moderators in their control rods.

[@Bagginsess]

@@ReptilianLepton nani desu ka baka-ro?

[@BigChimpEnergy]

- GG NO RE, Vladdy

[@Flappy9]

Why was Isaac dancing

[@KadeDev]

god it just keeps going huh?

[@-..._-.]

your channel is dying

[@seetheious9879]

>open google maps >check timeline

[@sipasa]

Imagine black hat hacking foreign targets were to be legal outside Russia or North Korea

[@guilherme5094]

👍

[@macpclinux1]

should be called fragmentator

[@demin-e]

I see how Kaspersky didn’t find any malware 😂

[@Smokkedandslammed]

Buncha fraggers all over muh computer! Get these dang fraggers outta here!

[@luisjorgeruizreyes1897]

Me who just downloaded Ease US about to spit my coffee

[@nullvoidpointer]

5:11 File smasher

[@ilyesatmania6510]

and what about the other side and "other sides"

[@belstar1128]

When most people think of hackers they think of Russia.

[@yourworstnightmare6513]

god content

[@hellvet3]

*rawr* I'm early? 🙀✨ Coed

[@iamtrash288]

Imaging using Windows for important documents. They totally had it coming.