WhisperGate

WhisperGate is a malicious software (malware) deployed by Unit 29155 cyber actors, known for their extensive use of this malware, particularly against Ukraine. The malware corrupts a system's master boot record, displays a fake ransomware note, and encrypts files based on specific file extensions. The deployment process involves two stages: stage1.exe and stage2.exe. WhisperGate is not exclusive to Unit 29155, as it has been used by other groups as well. It has also been associated with another malware called WhisperKill, which destroys files with specific extensions. The GRU Unit 29155 cyber actors began deploying the destructive WhisperGate malware against multiple Ukrainian victim organizations as early as January 13, 2022. Shortly after one such deployment, the actors exfiltrated data to mega[.]nz using Rclone. The Discord accounts associated with the WhisperGate campaign are categorized into three main clusters, labeled as Clusters 1, 2, and 3. A Cybersecurity Advisory provides tactics, techniques, and procedures (TTPs) associated with Unit 29155 cyber actors during and after their deployment of WhisperGate against Ukraine. In addition to WhisperGate and other incidents against Ukraine, Unit 29155 cyber actors have conducted computer network operations against numerous members of the North Atlantic Treaty Organization (NATO) in Europe and North America, as well as countries in Europe, Latin America, and Central Asia. Detailed technical analysis of the WhisperGate malware was conducted on samples collected from one victim, and further information is available in the joint advisory, "Destructive Malware Targeting Organizations in Ukraine," published on February 26, 2022.