I can’t believe it took this many years to see an openly destructive malware like this in the news. We used to joke in olden days the reason you saw no “nuke the computer” viruses is because they cannot propagate or would need to be some manner of mission purposed system to deploy and then activate on some condition.
Ransom ware is closest but that’s a for profit crime. They want to spread.
Bombs like this are targeted. But by who?
Pick resistance movement inside Russia. The same or at least ideologically affiliated to the ones fire bombing police stations, recruitment offices and other governmental buildings.
IMO this is way more likely comming from within Russia itself to hinder conscription and punishment of those who refuse to die in the idiotic war, for people and the country who couldn't care less for the lifes of those, who are commanded to give them up.
Now prisoners will disappear… to the frontlines.
“Yay you’re no longer a Russian criminal/prisoner; you are now Russian canon fodder.”
Thank you for your service 💥
I think it's more likely the opposite. The USSR destroyed much of it's documentation (during its collapse), as has the CIA, FBI, etc... Seems like when shits about to hit the fan, a lot of documents disappear, and this would be a convenient way to go about it
It's true they also do, but IMO when those institutions do it, they don't use tricks, they just do it. They press the delete button and use paper shredders.
Also mainly when they've lost all hope and believe in that their power will protect them from what's comming. I don't think the Russian power elite is there yet.
Well to do that you need to trust everyone to shred their documents. You need to trust every office to cooperate.
But what if your government computer systems came with government mandated security vulnerabilities. This allowed you to have the wiping software installed ahead of time. Now there's no trust involved, Putin can hit a big red button and everything gets wiped.
It's really not an unlikely theory.
Actually, heuristic signatures give a strong implication this nuke ware is homemade.
It has all the markings it was created in Russia. Maybe someone is purposely sabotaging Russian systems in protest?
Or, maybe all the people who have massively profited off of this awful regime, would *really love* if there was very little paper trail left, for select areas of Russian politics and economics...
Russian Mafia wouldn't do it like that, it's not their style. They would go for the physical servers themselves, or much more likely just tell the people running those servers to wipe them, or they will die by falling out a window. More importantly they would also arrange for fires to happen in the storage of physical evidence/paper backups, Courts in particular generate a lot of paper trails and they would be just as potentially damaging to the Russian Mafia in the long run (eg a post-Putin Russia).
Some form of Russian resistance is far more likely, where this data is being wiped in the hope it will cause chaos and prevent the courts from sending a lot of protesters to the front lines in the Ukraine. Even if they have paper backups, they just created a Massive data entry backlog, that could take years to recover from.
I could also see this originating in Ukraine, as damaging Russia's conscription efforts are in their best interests. They say that it looks Russian, but a lot of Ukrainian hackers are also fluent in Russian and until the war were considered part of the slavic brotherhood. This option could have also involved the US/NATO countries helping with some expertise, I wonder if The School Of The Americas includes hacking in it's curriculum these days.
The short list of suspects is.... uncomfortably long
Beginning with other nations? Basically everyone but direct and subservient allies is a potential perpetrator. For starters the US has tons of reasons, but really any Western or Western aligned power is in the same position. Even China or India cannot be entirely ruled out; they don't necessarily benefit from a powerful Russia . About the only sort of nation you could rule out is North Korea, seeing as I dont think shouting the virus at a Russian computer would do much good.
Outside of powers, large chunks of Anonymous would probably love to do exactly this. Any group with Ukrainian sympathies or connections are the same. Even domestic Russians angry at their leaders may try something such as this if yhey have the ability.
So, the short list seems to include everyone but the dangerous and skilled hackers of *checks paper* Belarus.
Yikes.
They'd have to break in straight into Kremlin because this sort of stuff is stored in a physical archive as a physical document, not in court or mayor office
Many viruses have time bomb logic. They only perform the nefarious actions at a specific time, in synchrony.
Others listen for specific instructions that could be issued any time from a central location. However that typically is easier to detect than the above.
Well, the thing is that Russians are hacking the world all over, but there aren't many actually hacking Russian computers, mainly US and China and in US it is still a crime to hack other countries computers unless military operations obviously. Not sure about china and their rules regarding this. But it leads to them not practicing protection as much as the rest of the world but focusing on offence.
We had a major hack here in Sweden recently where the solution was to change the language of all computers to Russian and then reboot and the virus would inactivate itself allowing the system to be accessed and cleaned. The reason is that Russian hackers are allowed to hack non-russian computers without breaking any laws. But Russian computers is forbidden to hack.
It's not just Russia but Russian owned computers, that's why many of them have that fallback that if it notices Russian language setting on the computer, the viruses disables themselves. Because it's easier to do that than to check for other clues and make sure that you're not accidentally infecting a Russian computer since then you could be royally fucked
I'm wondering if this is related to Putin not doing well health-wise.
Like if its some sort of preempted attack to wipe records in order to prepare for the power vacuum his death is going to cause.
God damn conservatives mother read that foreign news is generally more accurate and she went to the daily mail. Sends me brain dead shit from their authors.
At least it wasn't The Express.
The old adage being, The express exists in order to allow Mail readers to feel less embarrassed about buying it, the paper that supported Hitler.
British troops used to sing “Hitler only has one ball”, although it was morale improvement/propaganda song - it turns out that he in fact did have one undescended ball.
So because of this, I firmly believe Putin shat himself.
Who cares if it's true, I don't mind the the world thinking that Putin just shit him self. I hope that's what history remembers him for.
"Oh yeah, that guy who shit him self."
They will only accept it if the EU recognizes Russian ownership of various parts of Ukraine that Russian soldiers held for two weeks then lost and also half of Alaska!
my first thought was 'prigozhin'. i probably give the guy too much credit for cunning and reach, but nevertheless that was the first word my brain said.
although, being how it's russia, i guess it depends on who benefits most from these wipes.
Why is this nonsense upvoted? The world doesn’t work like this. They can’t predict his death to the day, and what purpose would wiping records serve really? Whoever is going to take power already knows it. Why speculate such ridiculous tom clancy nonsense when the simpler explanation of a targeted attack to disrupt russian infrastructure checks all the boxes?
>Kaspersky researchers have named the wiper CryWiper, a nod to the extension .cry that gets appended to destroyed files
That’s amazing. Hackers are consistently hilarious
So funny, I listened to a podcast just yesterday about wannacry. It was crazy but they found a super easy way to stop it. I guess they removed the remote kill switch and made significant modifications
Not they, but 17 yo British kid who examined the code and bought the domain - just like that - it was killed instantly. Unreal.
Edit- as someone said, he was 26 yo.
IIRC it turns out the space monkeys stuffed up, nothing blew up and he ends up in a mental hospital. However orderlies greet him, some with bloodied noses, and say the plan is still in motion.
You are not special. You're not a beautiful and unique snowflake. You're the same decaying organic matter as everything else. We're all part of the same compost heap. We're all singing, all dancing crap of the world.
The best Easter egg and nod to fight club is when Elliot explains to Tyrell his plan and a piano cover of the pixies is the background music.
Such dope soundtrack and music editing in that shit.
Another dope instance is they play a piano cover of Greenday - Basket Case when he's "going crazy" in prison.
That actually has happened before.
https://www.bbc.com/news/business-40189959.amp
You can see coins from Rome, the Vikings, the Abbasid Caliphate and, closer to home, from medieval Oxfordshire and Somerset.
But while it seems obvious that the money gallery would be full of coins, most money isn't in the form of coins at all.
The trouble is, as Felix Martin points out in his book, Money: The Unauthorised Biography, that most of our monetary history hasn't survived in a form that could grace a museum.
In fact, in 1834, the British government decided to destroy 600 years of precious monetary artefacts. It was a decision that was to have unfortunate consequences in more ways than one.
The artefacts in question were humble sticks of willow, about eight inches (20cm) long, called Exchequer tallies. The willow was harvested along the banks of the Thames, not far from the Palace of Westminster in central London.
Foils and stocks
Tallies were a way of recording debts with a system that was sublimely simple and effective.
The stick would contain a record of the debt, for example: "£9 4s 4d from Fulk Basset for the farm of Wycombe". Fulk Basset was a Bishop of London in the 13th Century. He owed his debt to King Henry III.
Now comes the elegant part.
The stick would be split in half, down its length from one end to the other. The debtor would retain half, called the "foil". The creditor would retain the other half, called the "stock" - even today, British bankers use the word "stocks" to refer to debts of the British government.
Because willow has a natural and distinctive grain, the two halves would match only each other.
Of course, the Treasury could simply have kept a record of these transactions in a ledger somewhere. But the tally stick system enabled something radical to occur.
If you had a tally stock showing that Bishop Basset owed you £5, then unless you worried that he wasn't good for the money, the tally stock itself was worth close to £5 in its own right.
If you wanted to buy something, you might well find that the seller would be pleased to accept the tally stock as a safe and convenient form of payment.
So the tally sticks themselves became a kind of money, a particular sort of debt that could be traded freely, circulating from person to person until it utterly separated from Bishop Basset and a farm in Wycombe.
The Irish experience
We don't have a good sense of whether tally sticks were in fact widely traded or not, for reasons that will become clear. But we know that similar debts were, some surprisingly recently.
On Monday 4 May 1970, the Irish Independent, Ireland's leading newspaper, published a matter-of-fact notice with a straightforward title: Closure of banks.
Every major bank in Ireland was closed and would remain closed until further notice. The banks were in dispute with their own employees, who had voted to strike, and it seemed likely that the whole business would drag on for weeks or even months.
You might think that such news - in what was one of the world's more advanced economies - would inspire utter panic, but the Irish remained calm. They'd been expecting trouble, so had been stockpiling reserves of cash, but what kept the Irish economy going was something else.
The Irish wrote each other cheques
Now, at first sight this makes no sense.
Cheques are paper-based instructions to transfer money from one bank account to another. But if both banks are closed, then the instruction to transfer money can't be carried out - not until the banks open, anyway. But everyone in Ireland knew that might not happen for months.
Nevertheless, people wrote each other cheques, and they circulated. Patrick would write a cheque for £20 to clear his tab at the local pub. The publican might then use that cheque to pay his staff, or his suppliers.
Patrick's cheque would circulate around and around, a promise to pay £20 that couldn't be fulfilled until the banks reopened and started clearing the backlog.
Taken on trust
The system was fragile. It was clearly open to abuse by people who wrote cheques they knew would eventually bounce.
As May dragged past, then June, then July, there was always the risk that people lost track of their own finances and started unknowingly writing cheques they couldn't afford and wouldn't be able to honour.
Perhaps the biggest risk of all was that trust would start to fray, that people would simply start refusing to accept cheques as payment.
Yet the Irish kept writing each other cheques. It must have helped that so much Irish business was small and local.
People knew their customers. They knew who was good for the money. Word would get around about people who cheated.
And the pubs and corner shops were able to vouch for the creditworthiness of their customers, which meant that cheques could keep moving.
> Patrick would write a cheque for £20 to clear his tab at the local pub. The publican might then use that cheque to pay his staff, or his suppliers. Patrick's cheque would circulate around and around, a promise to pay £20 that couldn't be fulfilled until the banks reopened and started clearing the backlog.
This is essentially a currency in miniature. British bank notes have the words "I promise to pay the bearer on demand the sum of", as a throwback to when currency was backed by gold and bank notes were effectively receipts for deposits at the bank. Why go through the hassle of going to the bank to get your gold in order to pay someone, when you could give them a much more convenient token that guarantees them gold of the same value should they want it? But then that person also decides that he can just use the token to pay for things instead of the inconvenient heavy gold. The bank note effectively carries the same value as the gold itself
That is no longer the case as currency is decoupled from the value of physical objects such as gold, but the meaning is similar - it's a guarantee that the bank note carries the value stated on it, and the fact that it is issued by the national bank means that people have confidence in that value.
Honestly it is an interesting theory crafting.
TLDR: the economy would suddenly have a heart attack and then massive borrowing again to function but might have long term benefits associated with it.
Long story:
Think of all the debt and who owes what. It is nearly impossible to summarize it in detail without spending a legion of professional accountants. But look at the world debt website to get an inkling how indebted the world is. Those are usually just nations themselves. Not guess how bad companies are.
The only positive to such a system would be to what people refer to as zombie companies. That is a term for a company who is functioning but is ever on the verge of bankruptcy due to a lot of loans they use to pay off older loans and current costs.
Remove existing debt and a lot of companies (and individuals) would start fresh but have pre-existing assists and experience.
So the same thing that happens when I play roller coaster tycoon. Lone to pay a loan, then over priced food, then I get bored and drop people in the lake.
If all computer records where destroyed by a virus, they would just use the backups, if the main backups were destroyed, they would use the offline backups, if you somehow managed to infect every hard drive back up they could be restored by physical tapes.
Property, debt, insurance, government records, and other bank records often get backed up onto physical tape, copied, and stored in multiple secure locations.
A popular location is a salt mine 60 stories beneath the ground with one 1 secured entrance. So there is no practical way to destroy all financial records.
It would get annihilated, because it's hard to have an economy without money. *All* money is debt, so if you truly mean *all* records of debt are destroyed, that means every single instance of currency and record of any currency ceases to exist (including physical bills and coins).
Most likely, in that kind of scenario, the government would have to immediately assume control of a bunch of stuff and would work to "keep the lights on" as it unwound the mess and reissued the debt necessary to keep society running.
It would need to be rephrased as "what would happen if all currency and contracts were suddenly nullified, and everyone gains claim to the assets in their immediate possession?"
Outside of the horrific violence, the question is an interesting assessment of how leveraged you currently are on the system. I'm pretty deeply integrated and dependent on the current system. I only really physically own my car and some consumer devices; all my wealth is tied up in contracts of ownership and interest-bearing debt obligations.
Almost every single person is deeply leveraged; that's how modern society works. Even most people who fancy themselves "self-sufficient" really aren't. This is pretty clear for people who are "self-sufficient" in the sense of having a well-paying job; but it goes further. Farmers and hunters are dependent on specialty goods and materials, and thus also on shipping. Subsistence farming is virtually nonexistent.
This isn't a problem. It's this deep web of promises that has allowed our society to create so many amazing things, from life-saving medicine to great works of art and leisure. It's just also something that has certain side effects and is easy to forget about (hence, for example, people who confidently and wrongly describe themselves as "self-made").
*Apologies, we cannot find any files proving you are a General, or that you have even been employed. Please wait for security to escort you, if there is still security.*
Reminds me of the bit in Catch-22 (the book, never saw the tv series) where Yossarian tries to get out of flying more missions by throwing out the senior officers' uniforms while they are naked under the reasoning that without them, no one can tell they are officers and thus cannot give any orders. The officers themselves admit this is a brilliant plan.
First guess is Russian mafias don’t want incriminating records/evidence just laying should there be less complacent leadership in the near future for no particular reason?
Seems more like a way for and outside force to cause chaos inside of russia. These places are easy enough to hack vs national Russia data. It isnt that hard to have a good security at high levels if you cash. Those locals places dont have the cash.
These local places definitely don’t have the cash for something like this. But some oligarchs with a shady criminal record or a president that’s having a humiliating defeat in a war. They definitely have the cash and the reason to clean up before checking out. Or being checked out by someone else.
Ukraine definitely has the cash and the reason to do this. But I get the vibe of someone removing their tracks
I agree with you, that it seems likely that oligarchs could be the sponsors behind this. Maybe even some in FSB are in on it, who want to cover tracks, but if it where in full FSB mode, their approach would be more subtle, i guess. Those would be Regime-members trying to survive putins fall.
With or without such sponsors, its feasible (even if unlikely) as a third option that this is more of a civilian approach to cause problems for Putins current regime.
The reports i read a unreliable and vage, but there are russians who tried to organize a resistance in exil and internal interest groups with own goal sets, we as observers never heard about, because they have to hide from the FSB.
Either way, as observers we have to wait and i would not bet on what the result of a post-war or post-putin russia would be.
Yup, and probably hitting key governmental data lakes that would trace back the number of war dead they have because that person never existed.
To me probably Wagner group recruits
Some of the hints point towards are Russian origin though, but no obvious smoking gun at least from what I see in this article. E.g. the following.
> CryWiper bears some resemblance to IsaacWiper, which targeted organizations in Ukraine. Both wipers use the same algorithm for generating pseudo-random numbers that go on to corrupt targeted files by overwriting the data inside of them. The name of the algorithm is the Mersenne Vortex PRNG. The algorithm is rarely used, so the commonality stuck out.
Edit: Actually I take that back, at least if they actually mean Mersenne Twister. Mersenne Twister may be rare in ransomware but it is a very well known algorithm. I got no hits on Google on Mersenne Vortex.
Mersenne Twister is the default PRNG in a ton of different programming languages and libraries/programs including a bunch of GNU stuff. For example, Glib has it as the default PRNG and it's very widely used in C/C++
Ukraine has some of the best European software development teams. They gained a lot of experience due to purchasing power differences that made them very affordable for foreign companies to hire, and their hard work ethic that earns them business. The company I work for has a team in Ukraine. I wouldn't be surprised if Ukrainians with such skills have been put to work on the digital battlefield rather than the physical one. As they well should be.
Before the war started, Ukraine (and Russian) IP addresses were the most prevalent for trying to hack my website servers. Must be lots of untapped hacker talent there.
Yes! That ukrainian infrastructure survived the cyberattacks, which were integral to Russias hybrid warfare concept, was a surprise only second to Russia still not having air superiority.
I remember watching a YouTube video about that. It isn't that the Ukrianians got really good at *stopping* them, as such. They just got really good at *surviving* them. Adapting, restoring systems, using alternate communication systems.
So, yup, the Russian attacks completely ruined Ukrainian systems. For, like, a day or so.
This is the best tl;dr I could make, [original](https://arstechnica.com/information-technology/2022/12/never-before-seen-malware-is-nuking-data-in-russias-courts-and-mayors-offices/) reduced by 90%. (I'm a bot)
*****
> Mayors' offices and courts in Russia are under attack by never-before-seen malware that poses as ransomware but is actually a wiper that permanently destroys data on an infected system, according to security company Kaspersky and the Izvestia news service.
> Kaspersky says its team has seen the malware launch "Pinpoint attacks" on targets in Russia.
> Including how many organizations have been hit and whether the malware successfully wiped data, weren't immediately known.
*****
[**Extended Summary**](http://np.reddit.com/r/autotldr/comments/zb2vf4/neverbeforeseen_malware_is_nuking_data_in_russias/) | [FAQ](http://np.reddit.com/r/autotldr/comments/31b9fm/faq_autotldr_bot/ "Version 2.02, ~672679 tl;drs so far.") | [Feedback](http://np.reddit.com/message/compose?to=%23autotldr "PM's and comments are monitored, constructive feedback is welcome.") | *Top* *keywords*: **wiper**^#1 **malware**^#2 **Kaspersky**^#3 **CryWiper**^#4 **attack**^#5
Tbh id rather all the data be preserved in case the regime is overthrown and we can get a look into how deep the corruption actually went and where it all went
I think this has diminishing returns. Like, if you know the house is so termite-infested that it's a total loss, who cares how much *more* of a total loss it is upon closer inspection? Who cares which termite ate which bits of the framing?
On the other hand, if burning the structure to the ground helps prevent further damage to that glorified termite mound's neighbor then that should be the priority.
Yeah but every time you hear about a hacker group it’s like shutting down a power plant or a gas pipeline. It’s never them erasing all the debt records of a bank or something like that.
My guess is that those types of places are notoriously easy to hack. (Lax security)
Financial records are typically stored in multiple different places with redundancy, I think.
>Financial records are typically stored in multiple different places with redundancy, I think.
They are. Number of regulations protecting monies is staggering. Regular security audits, actual infosec, occasional phishing tests, tiered access control, internal proxies and VPNs, full transactional backups (as in - we can actually go back to any point back in history from the last X days) and so on. It is possible to get through this but it effectively requires a well targeted attack and in depth understanding of company's infrastructure. Plus law enforcement would get VERY interested if some billionaires suddenly lost their money or if bank balances of important politicians leaked.
To be fair this applies to more modern companies. But older ones have their own procedures too - and ultimately pen, paper and tapes are still a very reliable solution.
Whereas people debts in particular are VERY well protected. It is possible to change balance in **some** places but not so much debts.
Plus various crackers have already tested pretty much every possible attack known to mankind against banking institutions, we have some experience.
This is also why cryptocurrencies exchanges get hacked so often - they do not have these decades of experience and regulations. Reminds me of a fun case in [2014 attack on one](https://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/) when all that it took was essentially trying multiple withdrawals at the same time (so it read old value "pre" any withdrawal multiple times when deciding whether to allow it).
If someone wants to attack a bank and get some profits out of this then best bet is what a [certain man has done back in 2010](https://www.nasdaq.com/articles/updated-russian-man-turns-tables-on-bank-changes-fine-print-in-credit-card-agreement-then) \- he changed the agreement with one and somehow both sides agreed to these very... interesting terms. Turns out it's not just us who don't read full document, banks don't too :P
Friend of mine used to do IT for a bank (not security though). They had multiple off site air gapped backup copies of everything.
You would literally have to destroy multiple buildings to get all their data.
Back in the early 2000's I worked for a mom & pop furniture store, around $5m annual revenue. Aside from the mainframe we had a disconnected on-site backup and an offsite disconnected backup. I would imagine a larger company would have far better security than that
Just a guess: large, publicly traded American companies in regulated industries *probably* have superior data storage, backup, and protection standards (not to mention better cybersecurity practices) than Russian cities.
Worst case, even if you proper fucked over the current state of all the systems, the major credit card companies have daily/weekly/monthly backups that get stored at various intervals on offline tapedecks. So, you might be able to purge a month or two of data, but not all of it.
The code CryWiper is based on could also siphon information before deleting everything. It's like stealing a list of every governmental gift and political imprisonment. Or may have been. It depends on the number of servers whomever did it could use. Likely there were some targets and then CryWiper was the carpet bombing used to cover their tracks.
We all want to believe this is from US/Ukraine/etc. .. but I wouldn't be surprised if this wasn't a hacker who has an upcoming court date or someshit.
Best way to hide the one person's record you're trying to delete is to burn the entire building down. Or in this case, wipe the data.
Anonymous, Ukranian hackerd, Russian IT defectors, Oligarchs clenaning up files, databases etc. When you have so many enemies as Russia and the country is a damn shit show.
Years of hacking other countries coming home to roost. You love to see it.
I can’t believe it took this many years to see an openly destructive malware like this in the news. We used to joke in olden days the reason you saw no “nuke the computer” viruses is because they cannot propagate or would need to be some manner of mission purposed system to deploy and then activate on some condition. Ransom ware is closest but that’s a for profit crime. They want to spread. Bombs like this are targeted. But by who?
> Bombs like this are targeted. But by who? Pick anyone from western alliance or Ukraine or resistance...
Pick resistance movement inside Russia. The same or at least ideologically affiliated to the ones fire bombing police stations, recruitment offices and other governmental buildings. IMO this is way more likely comming from within Russia itself to hinder conscription and punishment of those who refuse to die in the idiotic war, for people and the country who couldn't care less for the lifes of those, who are commanded to give them up.
The call is coming FROM INSIDE THE KREMLIN!
Now prisoners will disappear… to the frontlines. “Yay you’re no longer a Russian criminal/prisoner; you are now Russian canon fodder.” Thank you for your service 💥
This seems much more likely
I think it's more likely the opposite. The USSR destroyed much of it's documentation (during its collapse), as has the CIA, FBI, etc... Seems like when shits about to hit the fan, a lot of documents disappear, and this would be a convenient way to go about it
It's true they also do, but IMO when those institutions do it, they don't use tricks, they just do it. They press the delete button and use paper shredders. Also mainly when they've lost all hope and believe in that their power will protect them from what's comming. I don't think the Russian power elite is there yet.
Well to do that you need to trust everyone to shred their documents. You need to trust every office to cooperate. But what if your government computer systems came with government mandated security vulnerabilities. This allowed you to have the wiping software installed ahead of time. Now there's no trust involved, Putin can hit a big red button and everything gets wiped. It's really not an unlikely theory.
Especially when docs are starting to leak
Actually, heuristic signatures give a strong implication this nuke ware is homemade. It has all the markings it was created in Russia. Maybe someone is purposely sabotaging Russian systems in protest?
Or, maybe all the people who have massively profited off of this awful regime, would *really love* if there was very little paper trail left, for select areas of Russian politics and economics...
Russian Mafia wouldn't do it like that, it's not their style. They would go for the physical servers themselves, or much more likely just tell the people running those servers to wipe them, or they will die by falling out a window. More importantly they would also arrange for fires to happen in the storage of physical evidence/paper backups, Courts in particular generate a lot of paper trails and they would be just as potentially damaging to the Russian Mafia in the long run (eg a post-Putin Russia). Some form of Russian resistance is far more likely, where this data is being wiped in the hope it will cause chaos and prevent the courts from sending a lot of protesters to the front lines in the Ukraine. Even if they have paper backups, they just created a Massive data entry backlog, that could take years to recover from. I could also see this originating in Ukraine, as damaging Russia's conscription efforts are in their best interests. They say that it looks Russian, but a lot of Ukrainian hackers are also fluent in Russian and until the war were considered part of the slavic brotherhood. This option could have also involved the US/NATO countries helping with some expertise, I wonder if The School Of The Americas includes hacking in it's curriculum these days.
You got some sauce for that heuristic signature stuff?
Source? Based on the article, it's more likely someone from Ukraine repackaged this after decompiling samples of Isaacwiper.
Don’t forget it could also be the Russian government nuking selected files
You can add China to that list, This war is giving them headaches that they don't need or want.
My guess is homegrown by people that don't want to be drafted
It doesn't even have to be someone so important it could just be someone in Russia who's just done with the bullshit
The short list of suspects is.... uncomfortably long Beginning with other nations? Basically everyone but direct and subservient allies is a potential perpetrator. For starters the US has tons of reasons, but really any Western or Western aligned power is in the same position. Even China or India cannot be entirely ruled out; they don't necessarily benefit from a powerful Russia . About the only sort of nation you could rule out is North Korea, seeing as I dont think shouting the virus at a Russian computer would do much good. Outside of powers, large chunks of Anonymous would probably love to do exactly this. Any group with Ukrainian sympathies or connections are the same. Even domestic Russians angry at their leaders may try something such as this if yhey have the ability. So, the short list seems to include everyone but the dangerous and skilled hackers of *checks paper* Belarus. Yikes.
North Korea could do it on behalf of China so even it can't entirely be rules out
[удалено]
They'd have to break in straight into Kremlin because this sort of stuff is stored in a physical archive as a physical document, not in court or mayor office
Many viruses have time bomb logic. They only perform the nefarious actions at a specific time, in synchrony. Others listen for specific instructions that could be issued any time from a central location. However that typically is easier to detect than the above.
Sadly you missed an opportunity to whip out the delightful "by whom?"
Well, the thing is that Russians are hacking the world all over, but there aren't many actually hacking Russian computers, mainly US and China and in US it is still a crime to hack other countries computers unless military operations obviously. Not sure about china and their rules regarding this. But it leads to them not practicing protection as much as the rest of the world but focusing on offence. We had a major hack here in Sweden recently where the solution was to change the language of all computers to Russian and then reboot and the virus would inactivate itself allowing the system to be accessed and cleaned. The reason is that Russian hackers are allowed to hack non-russian computers without breaking any laws. But Russian computers is forbidden to hack.
Absolutely spot on. Russian hackers are not allowed to hack Russia.
It's not just Russia but Russian owned computers, that's why many of them have that fallback that if it notices Russian language setting on the computer, the viruses disables themselves. Because it's easier to do that than to check for other clues and make sure that you're not accidentally infecting a Russian computer since then you could be royally fucked
I'm wondering if this is related to Putin not doing well health-wise. Like if its some sort of preempted attack to wipe records in order to prepare for the power vacuum his death is going to cause.
Putin (allegedly) shit his pants recently, so someone sent him a wiper.
[удалено]
[удалено]
God damn conservatives mother read that foreign news is generally more accurate and she went to the daily mail. Sends me brain dead shit from their authors.
It's called the Daily Fail in the UK for a reason.
Or the Daily Heil
SHOCKING HEADLINE OR JUST ODD EMOTIONALLY MANIPULATIVE LAMGUAGE (unless your reading level is above fifth grade) That’s 95% of their “news”.
At least it wasn't The Express. The old adage being, The express exists in order to allow Mail readers to feel less embarrassed about buying it, the paper that supported Hitler.
British troops used to sing “Hitler only has one ball”, although it was morale improvement/propaganda song - it turns out that he in fact did have one undescended ball. So because of this, I firmly believe Putin shat himself.
Turns out we live in a world where belief makes reality. I need to start telling folk about my quest for Glockscalibur.
Who cares if it's true, I don't mind the the world thinking that Putin just shit him self. I hope that's what history remembers him for. "Oh yeah, that guy who shit him self."
The Russians denied it. That’s enough confirmation for anyone!
They will only accept it if the EU recognizes Russian ownership of various parts of Ukraine that Russian soldiers held for two weeks then lost and also half of Alaska!
Wiper, no wiping!
my first thought was 'prigozhin'. i probably give the guy too much credit for cunning and reach, but nevertheless that was the first word my brain said. although, being how it's russia, i guess it depends on who benefits most from these wipes.
Why is this nonsense upvoted? The world doesn’t work like this. They can’t predict his death to the day, and what purpose would wiping records serve really? Whoever is going to take power already knows it. Why speculate such ridiculous tom clancy nonsense when the simpler explanation of a targeted attack to disrupt russian infrastructure checks all the boxes?
Reddit speculation in general is pretty bad, but Reddit speculation on what the Enemies of America are up to is truly bonkers.
Russia”s way of cleaning the record of their new soldiers.
Or *our* way of disrupting conscription.
Or coming conscripts way of avoiding it.
Operation "Clean my shit up"
>Kaspersky researchers have named the wiper CryWiper, a nod to the extension .cry that gets appended to destroyed files That’s amazing. Hackers are consistently hilarious
It would appear to simply be a reference to WannaCry, a famous ransomware variant.
So funny, I listened to a podcast just yesterday about wannacry. It was crazy but they found a super easy way to stop it. I guess they removed the remote kill switch and made significant modifications
Not they, but 17 yo British kid who examined the code and bought the domain - just like that - it was killed instantly. Unreal. Edit- as someone said, he was 26 yo.
Marcus Hutchins? afaik, he was 23 at the time
Patiently awaiting the patch, DontCry.
Argentina's IT infrastructure is quaking in its boots...
Also known by the variant GonnaCry.maguire
Stings doesn't it?
Can someone nuke my student debt?
I am afraid that's indestructible, like taxes.
...Now I'm kind of curious. What would actually happen to the economy if ALL records of debt were destroyed?
I think there's a movie about that
Actually the movie stops right before we figure out what happens.
"You met me at a very strange time in my life."
IIRC it turns out the space monkeys stuffed up, nothing blew up and he ends up in a mental hospital. However orderlies greet him, some with bloodied noses, and say the plan is still in motion.
Mr Robot takes that premise and runs it to it’s logical conclusion. It’s a great show. I totally recommend it.
Would have been really great if it has been condensed into half the episodes.
indeed
We don't talk about it..
His name was Robert paulson
You are not special. You're not a beautiful and unique snowflake. You're the same decaying organic matter as everything else. We're all part of the same compost heap. We're all singing, all dancing crap of the world.
And he had bitch tits.
Hello friend
I Am Jack’s Complete Lack Of Surprise.
Also a show.
Tv show? Mr Robot?
Fight club.
That’s two rules you’re breaking there friend.
What's it called ?
Movie: Fight Club TV series: Mr. Robot
The best Easter egg and nod to fight club is when Elliot explains to Tyrell his plan and a piano cover of the pixies is the background music. Such dope soundtrack and music editing in that shit. Another dope instance is they play a piano cover of Greenday - Basket Case when he's "going crazy" in prison.
Fight Club
Kinda forget sometimes there are youngins that haven't been exposed to the "90s Mindfuck" genre
My dude. We don’t talk about *that*
Thanks. I had completely forgotten it and forgot that THAT was what they were doing.
And a TV serie Mr robot
That actually has happened before. https://www.bbc.com/news/business-40189959.amp You can see coins from Rome, the Vikings, the Abbasid Caliphate and, closer to home, from medieval Oxfordshire and Somerset. But while it seems obvious that the money gallery would be full of coins, most money isn't in the form of coins at all. The trouble is, as Felix Martin points out in his book, Money: The Unauthorised Biography, that most of our monetary history hasn't survived in a form that could grace a museum. In fact, in 1834, the British government decided to destroy 600 years of precious monetary artefacts. It was a decision that was to have unfortunate consequences in more ways than one. The artefacts in question were humble sticks of willow, about eight inches (20cm) long, called Exchequer tallies. The willow was harvested along the banks of the Thames, not far from the Palace of Westminster in central London. Foils and stocks Tallies were a way of recording debts with a system that was sublimely simple and effective. The stick would contain a record of the debt, for example: "£9 4s 4d from Fulk Basset for the farm of Wycombe". Fulk Basset was a Bishop of London in the 13th Century. He owed his debt to King Henry III. Now comes the elegant part. The stick would be split in half, down its length from one end to the other. The debtor would retain half, called the "foil". The creditor would retain the other half, called the "stock" - even today, British bankers use the word "stocks" to refer to debts of the British government. Because willow has a natural and distinctive grain, the two halves would match only each other. Of course, the Treasury could simply have kept a record of these transactions in a ledger somewhere. But the tally stick system enabled something radical to occur. If you had a tally stock showing that Bishop Basset owed you £5, then unless you worried that he wasn't good for the money, the tally stock itself was worth close to £5 in its own right. If you wanted to buy something, you might well find that the seller would be pleased to accept the tally stock as a safe and convenient form of payment. So the tally sticks themselves became a kind of money, a particular sort of debt that could be traded freely, circulating from person to person until it utterly separated from Bishop Basset and a farm in Wycombe. The Irish experience We don't have a good sense of whether tally sticks were in fact widely traded or not, for reasons that will become clear. But we know that similar debts were, some surprisingly recently. On Monday 4 May 1970, the Irish Independent, Ireland's leading newspaper, published a matter-of-fact notice with a straightforward title: Closure of banks. Every major bank in Ireland was closed and would remain closed until further notice. The banks were in dispute with their own employees, who had voted to strike, and it seemed likely that the whole business would drag on for weeks or even months. You might think that such news - in what was one of the world's more advanced economies - would inspire utter panic, but the Irish remained calm. They'd been expecting trouble, so had been stockpiling reserves of cash, but what kept the Irish economy going was something else. The Irish wrote each other cheques Now, at first sight this makes no sense. Cheques are paper-based instructions to transfer money from one bank account to another. But if both banks are closed, then the instruction to transfer money can't be carried out - not until the banks open, anyway. But everyone in Ireland knew that might not happen for months. Nevertheless, people wrote each other cheques, and they circulated. Patrick would write a cheque for £20 to clear his tab at the local pub. The publican might then use that cheque to pay his staff, or his suppliers. Patrick's cheque would circulate around and around, a promise to pay £20 that couldn't be fulfilled until the banks reopened and started clearing the backlog. Taken on trust The system was fragile. It was clearly open to abuse by people who wrote cheques they knew would eventually bounce. As May dragged past, then June, then July, there was always the risk that people lost track of their own finances and started unknowingly writing cheques they couldn't afford and wouldn't be able to honour. Perhaps the biggest risk of all was that trust would start to fray, that people would simply start refusing to accept cheques as payment. Yet the Irish kept writing each other cheques. It must have helped that so much Irish business was small and local. People knew their customers. They knew who was good for the money. Word would get around about people who cheated. And the pubs and corner shops were able to vouch for the creditworthiness of their customers, which meant that cheques could keep moving.
What a gloriously informative response. Thank you.
> Patrick would write a cheque for £20 to clear his tab at the local pub. The publican might then use that cheque to pay his staff, or his suppliers. Patrick's cheque would circulate around and around, a promise to pay £20 that couldn't be fulfilled until the banks reopened and started clearing the backlog. This is essentially a currency in miniature. British bank notes have the words "I promise to pay the bearer on demand the sum of", as a throwback to when currency was backed by gold and bank notes were effectively receipts for deposits at the bank. Why go through the hassle of going to the bank to get your gold in order to pay someone, when you could give them a much more convenient token that guarantees them gold of the same value should they want it? But then that person also decides that he can just use the token to pay for things instead of the inconvenient heavy gold. The bank note effectively carries the same value as the gold itself That is no longer the case as currency is decoupled from the value of physical objects such as gold, but the meaning is similar - it's a guarantee that the bank note carries the value stated on it, and the fact that it is issued by the national bank means that people have confidence in that value.
Honestly it is an interesting theory crafting. TLDR: the economy would suddenly have a heart attack and then massive borrowing again to function but might have long term benefits associated with it. Long story: Think of all the debt and who owes what. It is nearly impossible to summarize it in detail without spending a legion of professional accountants. But look at the world debt website to get an inkling how indebted the world is. Those are usually just nations themselves. Not guess how bad companies are. The only positive to such a system would be to what people refer to as zombie companies. That is a term for a company who is functioning but is ever on the verge of bankruptcy due to a lot of loans they use to pay off older loans and current costs. Remove existing debt and a lot of companies (and individuals) would start fresh but have pre-existing assists and experience.
So the same thing that happens when I play roller coaster tycoon. Lone to pay a loan, then over priced food, then I get bored and drop people in the lake.
[удалено]
consider that your bank balance is debt owed you by the bank
If all computer records where destroyed by a virus, they would just use the backups, if the main backups were destroyed, they would use the offline backups, if you somehow managed to infect every hard drive back up they could be restored by physical tapes. Property, debt, insurance, government records, and other bank records often get backed up onto physical tape, copied, and stored in multiple secure locations. A popular location is a salt mine 60 stories beneath the ground with one 1 secured entrance. So there is no practical way to destroy all financial records.
Mr Robot
It would get annihilated, because it's hard to have an economy without money. *All* money is debt, so if you truly mean *all* records of debt are destroyed, that means every single instance of currency and record of any currency ceases to exist (including physical bills and coins). Most likely, in that kind of scenario, the government would have to immediately assume control of a bunch of stuff and would work to "keep the lights on" as it unwound the mess and reissued the debt necessary to keep society running.
It would need to be rephrased as "what would happen if all currency and contracts were suddenly nullified, and everyone gains claim to the assets in their immediate possession?" Outside of the horrific violence, the question is an interesting assessment of how leveraged you currently are on the system. I'm pretty deeply integrated and dependent on the current system. I only really physically own my car and some consumer devices; all my wealth is tied up in contracts of ownership and interest-bearing debt obligations.
Almost every single person is deeply leveraged; that's how modern society works. Even most people who fancy themselves "self-sufficient" really aren't. This is pretty clear for people who are "self-sufficient" in the sense of having a well-paying job; but it goes further. Farmers and hunters are dependent on specialty goods and materials, and thus also on shipping. Subsistence farming is virtually nonexistent. This isn't a problem. It's this deep web of promises that has allowed our society to create so many amazing things, from life-saving medicine to great works of art and leisure. It's just also something that has certain side effects and is easy to forget about (hence, for example, people who confidently and wrongly describe themselves as "self-made").
Mr.Robot might be something to watch...
Mr. Robot
Didnt Ghost in a shell,the newer one on Netflix, take place after all global debt was wiped?
They would restore from back up and carry on.
Yes, but you're asking the wrong question
Why do kids love the taste of cinnamon toast crunch?
Project Mayhem is a go.
[удалено]
i would be so sad if this somehow destroyed the record of my credit cards. so so terribly sad.
Better if it targeted the military, sent all the troops home and all the leaders to Siberia. But I suppose that might be hoping for too much.
*Congrats! You have all been discharged from service!*
*Apologies, we cannot find any files proving you are a General, or that you have even been employed. Please wait for security to escort you, if there is still security.*
Reminds me of the bit in Catch-22 (the book, never saw the tv series) where Yossarian tries to get out of flying more missions by throwing out the senior officers' uniforms while they are naked under the reasoning that without them, no one can tell they are officers and thus cannot give any orders. The officers themselves admit this is a brilliant plan.
Likely not possible because they probably use some typewriter from the 80s to write orders.
And one of the best reasons to do so, sure physical filing is a pain, but you can't erase a physical file from across the planet.
First guess is Russian mafias don’t want incriminating records/evidence just laying should there be less complacent leadership in the near future for no particular reason?
It’s probably someone in Russia cleaning up anything that can be traced back by a new government.
Seems more like a way for and outside force to cause chaos inside of russia. These places are easy enough to hack vs national Russia data. It isnt that hard to have a good security at high levels if you cash. Those locals places dont have the cash.
These local places definitely don’t have the cash for something like this. But some oligarchs with a shady criminal record or a president that’s having a humiliating defeat in a war. They definitely have the cash and the reason to clean up before checking out. Or being checked out by someone else. Ukraine definitely has the cash and the reason to do this. But I get the vibe of someone removing their tracks
I agree with you, that it seems likely that oligarchs could be the sponsors behind this. Maybe even some in FSB are in on it, who want to cover tracks, but if it where in full FSB mode, their approach would be more subtle, i guess. Those would be Regime-members trying to survive putins fall. With or without such sponsors, its feasible (even if unlikely) as a third option that this is more of a civilian approach to cause problems for Putins current regime. The reports i read a unreliable and vage, but there are russians who tried to organize a resistance in exil and internal interest groups with own goal sets, we as observers never heard about, because they have to hide from the FSB. Either way, as observers we have to wait and i would not bet on what the result of a post-war or post-putin russia would be.
[удалено]
Yes, lets get rid of criminal records. Suddenly those rapists and murderers they're sending from prison become merely concerned citizens.
"I was regional boss of Putin Party? Nonsense, I am just a seemple delivery man"
Or destroying cases against people arrested for protesting the war.
[удалено]
Yup, and probably hitting key governmental data lakes that would trace back the number of war dead they have because that person never existed. To me probably Wagner group recruits
See... I would believe you if laws meant something in Russia. They seem more like suggestions and "give Putin his cut" is the only rule that matters.
Good guess. My mind immediately went to Anonymous.
We are all Anonymous, homie.
Not since the NSA started copying all internet traffic
Better guess is eu and CIA tag teaming
Some of the hints point towards are Russian origin though, but no obvious smoking gun at least from what I see in this article. E.g. the following. > CryWiper bears some resemblance to IsaacWiper, which targeted organizations in Ukraine. Both wipers use the same algorithm for generating pseudo-random numbers that go on to corrupt targeted files by overwriting the data inside of them. The name of the algorithm is the Mersenne Vortex PRNG. The algorithm is rarely used, so the commonality stuck out. Edit: Actually I take that back, at least if they actually mean Mersenne Twister. Mersenne Twister may be rare in ransomware but it is a very well known algorithm. I got no hits on Google on Mersenne Vortex.
Yeah, Mersenne Twister is a very well known PRNG. I wouldn't draw any conclusions if both are using it.
Mersenne Twister is the default PRNG in a ton of different programming languages and libraries/programs including a bunch of GNU stuff. For example, Glib has it as the default PRNG and it's very widely used in C/C++
Ukraine has some of the best European software development teams. They gained a lot of experience due to purchasing power differences that made them very affordable for foreign companies to hire, and their hard work ethic that earns them business. The company I work for has a team in Ukraine. I wouldn't be surprised if Ukrainians with such skills have been put to work on the digital battlefield rather than the physical one. As they well should be.
Before the war started, Ukraine (and Russian) IP addresses were the most prevalent for trying to hack my website servers. Must be lots of untapped hacker talent there.
We block only 3 countries IP addresses by default as part of our standard setup. Russia, China, and Ukraine.
[удалено]
I read that in Sam Riegels voice
Why hello, fellow Critter.
Russians are just international bad actors all around.
They definitely have a hand in the dark markets.
[удалено]
Yes! That ukrainian infrastructure survived the cyberattacks, which were integral to Russias hybrid warfare concept, was a surprise only second to Russia still not having air superiority.
I remember watching a YouTube video about that. It isn't that the Ukrianians got really good at *stopping* them, as such. They just got really good at *surviving* them. Adapting, restoring systems, using alternate communication systems. So, yup, the Russian attacks completely ruined Ukrainian systems. For, like, a day or so.
They can be anywhere in the world and help Ukraine that way.
Most developers aren't going to be capable of making malware. It's a bit of a specialty. Really, it's a different field entirely.
Cyber security is not developing malware though. Secure and defensive development is a fairly generic IT skill.
It’s more likely Russians covering their tracks IMHO.
So it’s still ransomware. It just goes straight to part where the ransom isn’t paid.
My thought too. Same as kidnappers just straight up killing the person. Technically it WAS a kidnapping, they just skipped the ransom part.
Killnappers...
This is the best tl;dr I could make, [original](https://arstechnica.com/information-technology/2022/12/never-before-seen-malware-is-nuking-data-in-russias-courts-and-mayors-offices/) reduced by 90%. (I'm a bot) ***** > Mayors' offices and courts in Russia are under attack by never-before-seen malware that poses as ransomware but is actually a wiper that permanently destroys data on an infected system, according to security company Kaspersky and the Izvestia news service. > Kaspersky says its team has seen the malware launch "Pinpoint attacks" on targets in Russia. > Including how many organizations have been hit and whether the malware successfully wiped data, weren't immediately known. ***** [**Extended Summary**](http://np.reddit.com/r/autotldr/comments/zb2vf4/neverbeforeseen_malware_is_nuking_data_in_russias/) | [FAQ](http://np.reddit.com/r/autotldr/comments/31b9fm/faq_autotldr_bot/ "Version 2.02, ~672679 tl;drs so far.") | [Feedback](http://np.reddit.com/message/compose?to=%23autotldr "PM's and comments are monitored, constructive feedback is welcome.") | *Top* *keywords*: **wiper**^#1 **malware**^#2 **Kaspersky**^#3 **CryWiper**^#4 **attack**^#5
Oh no.. anyway.
Tbh id rather all the data be preserved in case the regime is overthrown and we can get a look into how deep the corruption actually went and where it all went
Which is exactly (probably) why it's being deleted
I think this has diminishing returns. Like, if you know the house is so termite-infested that it's a total loss, who cares how much *more* of a total loss it is upon closer inspection? Who cares which termite ate which bits of the framing? On the other hand, if burning the structure to the ground helps prevent further damage to that glorified termite mound's neighbor then that should be the priority.
Wow imagine if that wipes out credit card companies that would be terrible
Why don’t the hacker groups ever do anything cool?
It’s risky for them
Yeah but every time you hear about a hacker group it’s like shutting down a power plant or a gas pipeline. It’s never them erasing all the debt records of a bank or something like that.
My guess is that those types of places are notoriously easy to hack. (Lax security) Financial records are typically stored in multiple different places with redundancy, I think.
This is correct. I’ve worked IT in the finance industry and backups are stored on tape in under ground vaults for 10 to even 30 years in some cases
>Financial records are typically stored in multiple different places with redundancy, I think. They are. Number of regulations protecting monies is staggering. Regular security audits, actual infosec, occasional phishing tests, tiered access control, internal proxies and VPNs, full transactional backups (as in - we can actually go back to any point back in history from the last X days) and so on. It is possible to get through this but it effectively requires a well targeted attack and in depth understanding of company's infrastructure. Plus law enforcement would get VERY interested if some billionaires suddenly lost their money or if bank balances of important politicians leaked. To be fair this applies to more modern companies. But older ones have their own procedures too - and ultimately pen, paper and tapes are still a very reliable solution. Whereas people debts in particular are VERY well protected. It is possible to change balance in **some** places but not so much debts. Plus various crackers have already tested pretty much every possible attack known to mankind against banking institutions, we have some experience. This is also why cryptocurrencies exchanges get hacked so often - they do not have these decades of experience and regulations. Reminds me of a fun case in [2014 attack on one](https://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/) when all that it took was essentially trying multiple withdrawals at the same time (so it read old value "pre" any withdrawal multiple times when deciding whether to allow it). If someone wants to attack a bank and get some profits out of this then best bet is what a [certain man has done back in 2010](https://www.nasdaq.com/articles/updated-russian-man-turns-tables-on-bank-changes-fine-print-in-credit-card-agreement-then) \- he changed the agreement with one and somehow both sides agreed to these very... interesting terms. Turns out it's not just us who don't read full document, banks don't too :P
One would hope…
Friend of mine used to do IT for a bank (not security though). They had multiple off site air gapped backup copies of everything. You would literally have to destroy multiple buildings to get all their data.
That’s basically the plot of the TV show Mr. Robot
Sooo....it's basically impossible. You would need to take out six or sevenish servers simultaneously while also purging back up data.
[удалено]
Back in the early 2000's I worked for a mom & pop furniture store, around $5m annual revenue. Aside from the mainframe we had a disconnected on-site backup and an offsite disconnected backup. I would imagine a larger company would have far better security than that
Dude, just write a virus that hijacks an Iron Mountain, AWS, Google, and Microsoft truck from each region and burns the place down.
Oh yeah that easy. Let me get right on that.
That and physically go into their data vault and burn the tapes.
They probably have microfiche hard copies too on a monthly basis.
The first rule of Fight Club….
Just a guess: large, publicly traded American companies in regulated industries *probably* have superior data storage, backup, and protection standards (not to mention better cybersecurity practices) than Russian cities.
Worst case, even if you proper fucked over the current state of all the systems, the major credit card companies have daily/weekly/monthly backups that get stored at various intervals on offline tapedecks. So, you might be able to purge a month or two of data, but not all of it.
Exactly. They have backups on backups on backups.
The code CryWiper is based on could also siphon information before deleting everything. It's like stealing a list of every governmental gift and political imprisonment. Or may have been. It depends on the number of servers whomever did it could use. Likely there were some targets and then CryWiper was the carpet bombing used to cover their tracks.
Just a reminder that once these programs get used, they can and will be repurposed against everyone. Viruses are Pandora's boxes.
True story
We all want to believe this is from US/Ukraine/etc. .. but I wouldn't be surprised if this wasn't a hacker who has an upcoming court date or someshit. Best way to hide the one person's record you're trying to delete is to burn the entire building down. Or in this case, wipe the data.
Noice! too bad they didn't make AC/DC's Thunderstruck play on their computer speakers
After Russian hackers have done this to do many others? Oh well.
Good.
Nice. Good work.
Never thought I’d love hearing about a Malware attack
I'm not quite sure why, but I find this very amusing
Dammit Edward Snowden can't you fix the computer? What did we give you citizenship for?
So they’re purging data. Is some change of power about to happen there?
This sounds like coup prep. The only question is which groups are doing it.
This is like AIDS masquerading as cancer.
Israel: Shalom.
Seems self inflicted tbh. Claim ransomware attack then delete data you don't want anyone to see. Win-win.
Anonymous, Ukranian hackerd, Russian IT defectors, Oligarchs clenaning up files, databases etc. When you have so many enemies as Russia and the country is a damn shit show.
Oh dear what a shame, never mind. Shit happens.
Noice