DarkOwl Finds No Evidence Linking Ukrainian Darknet Data Leaks to January Attacks
Summary
DarkOwl analyzed Ukrainian government and civilian data offered on darknet forums and services, finding no evidence it was obtained in January’s cyberattacks. The review documented exposed personal and medical data while noting uncertainty about sellers and attribution.
Key points
- DarkOwl found no conclusive evidence that the Ukrainian data appearing on darknet services in January was stolen during the mid-January cyberattacks; some data may have been released to intimidate Ukrainians.
- A DIIA database sample contained personal details including contact information and passport numbers; other DIIA files included applicant records and medical data consent information.
- A Medstar database sample contained 669 medical appointments with patient information and photos; its latest appointment was dated November 30, 2021.
- The Free Civilian Tor service offered larger datasets, including DIIA and driver and vehicle records; both were marked sold by the time of publication. The sales claims do not establish the datasets’ authenticity or origin.
- The January 13–14 attacks involved website defacements and WhisperGate, a destructive malware campaign designed to resemble ransomware. Ukraine’s SBU said more than 70 organizations were targeted and 10 experienced unauthorized interference, while reporting no personal data compromised or leaked in those attacks.
- Attribution remained uncertain: a Ukrainian official attributed the January defacements to UNC1151, while the article says UNC1151’s role in the attacks was indeterminate.
Article Details
- Attack Vectors
- On 13–14 January 2022, attackers defaced public-facing Ukrainian government websites and used a vulnerability in OctoberCMS, according to technical analysis cited in the article.
- WhisperGate used a two-stage destructive process: the first stage overwrote the master boot record with a ransom note, and the second downloaded the file Tbopbh.jpg from a Discord server to overwrite targeted files with 0xCC bytes.
- The WhisperGate campaign mimicked ransomware with a $10,000 Bitcoin demand, but Microsoft incident responders assessed that the demand was a pretext and the malware was designed to destroy data.
- Ukraine experienced reported DDoS attacks against government, financial, and military organizations in January, February, and on 23 February 2022; the February attacks took organizations offline.
- HermeticWiper (KillDisk.NCV) was reported deployed against strategic cyber targets on 23 February 2022; the article describes it as a hard-disk wiper.
- A user identified as Vaticano offered samples and larger databases allegedly taken from Ukrainian organizations for sale on Raid Forums and the Free Civilian Tor service. The article says there is no evidence these datasets came from the January attacks.
- Fake text messages reportedly told Privatbank users that ATMs were out of service, increasing stress on the bank's network; the article does not establish who sent them.
MITRE ATT&CK
T1105 · Ingress Tool TransferThe WhisperGate second stage downloaded Tbopbh.jpg from a Discord server.T1190 · Exploit Public-Facing ApplicationTechnical analysis cited in the article suggests an OctoberCMS vulnerability enabled the website defacements.T1491.002 · External DefacementAttackers defaced public-facing Ukrainian government websites with a threatening message.T1498 · Network Denial of ServiceReported DDoS attacks took Ukrainian government, financial, and military organizations offline.T1561.001 · Disk Content WipeWhisperGate's second stage used Tbopbh.jpg to overwrite targeted files with 0xCC bytes.T1561.002 · Disk Structure WipeWhisperGate's first stage overwrote the master boot record with a ransom note.
People
Threat Actors
CyberpartisansSelf-described pro-democracy hacktivist group that claimed responsibility for an attack on Belarus's rail network and previously said it tapped Belarusian Ministry of Internal Affairs phone lines.UNC1151Serhiy Demedyuk attributed the January defacements to UNC1151. The article says direct attribution of UNC1151's role in the attacks is indeterminate.VaticanoRaid Forums user who offered databases allegedly taken from Ukrainian organizations; DarkOwl assessed that the Free Civilian Tor service might be affiliated with this persona.
Malware
HermeticWiperBreaking news indicates Russia deployed a new hard disk wiper malware variant called HermeticWiper (KillDisk.NCV) across strategic cyber targets on the 23rd of February prior to the full-scale military invasion ofTbopbh.jpgboot record (MBR) with a ransom note; and, the second stage downloads a data-corruption malware named Tbopbh.jpg that overwrites targeted files with a fixed number of 0xCC bytes.WhisperGateof 13th-14th of January, including deployment of what security researchers have identified as the “WhisperGate” malware.
Vendors
CrowdStrikeCybersecurity units at Microsoft, Crowdstrike, and Palo Alto Networks have published expert descriptions of the threat attack vectors deployed on the night of the January 13 cyberattacks against cyber targets acrossMicrosoftMicrosoft’s incident responders indicated the destructive malware campaign was designed to mimic extortion-based ransomware, by deleting critical files, locking down the systems, and loading a ransom note demandingPalo Alto NetworksCybersecurity units at Microsoft, Crowdstrike, and Palo Alto Networks have published expert descriptions of the threat attack vectors deployed on the night of the January 13 cyberattacks against cyber targets across
Products
Countries
BelarusDemedyuk, officially attributes the 13/14 January defacements to a cybercriminal group operating out of Belarus identified as UNC1151.Polandresources in an attempt to align with the original messaging of the website defacements in 2022 to blame Poland for the attack.RussiaHours later Russia launched direct kinetic attacks against strategic targets around the country and ground forces crossed the border on multiple fronts.UkraineDarkOwl is aware that as of February 23rd, 2022 Ukraine’s digital infrastructure came under further significant DDoS attacks, with several government and financial websites under duress.
Industries
EnergyDays after the PFU leak, a post titled, DTEK[UA] appeared with the offer to sell over 200 credentials exfiltrated from employees at a large energy investor in Ukraine.GovernmentDarkOwl is aware that as of February 23rd, 2022 Ukraine’s digital infrastructure came under further significant DDoS attacks, with several government and financial websites under duress.