HermeticWiper coverage

[Marvin]

Hello,

HermeticWiper: New data‑wiping malware hits Ukraine

https://www.welivesecurity.com/2022/02/24/hermeticwiper-new-data-wiping-malware-hits-ukraine/

HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine

https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/

Is there any news if McAfee products can detect HermeticWiper, malware currently used on Ukraine?

Serge

[Nielsb]

No advisory from McAfee/Trelllix

Last update from John Fokker: https://twitter.com/TrellixLabs/status/1496910495411949573

Given the sensitivity around the case we have to keep it limited to what we shared above. But for more IOCs and threat data make sure to check our dashboard

Trellix labs: https://twitter.com/TrellixLabs/status/1496910495411949573

hash in the twitter post:

https://www.virustotal.com/gui/file/1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591

https://www.virustotal.com/gui/file/a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92

[Nielsb]

The hashes in post: https://twitter.com/fr0gger_/status/1496968238013759492

0d8cc992f279ec45e8b8dfd05a700ff1f0437f29
https://www.virustotal.com/gui/file/3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767

d9a3596af0463797df4ff25b7999184946e3bfa2
https://www.virustotal.com/gui/file/2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf

912342f1c840a42f6b74132f8a7c4ffe7d40fb77
https://www.virustotal.com/gui/file/0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da

61b25d11392172e587d8da3045812a66c3385451
https://www.virustotal.com/gui/file/1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591

[harshgautam · Accepted solution]

Hi @Marvin ,

Thank you for reaching out to us on Community portal.

As of now, we do have coverage for the Hermetic Wiper Malware through an ED.

Kindly log a case with us and we shall share you the required details.

Adding the advisory for reference- 

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a solution" if this reply resolves your query!

[Marvin]

What's an "ED" ?
I already opened an SR last week, I came here because it's too d*mn slow.

[harshgautam]

H @Marvin ,

ED stands for ExtraDAT. once the ED is provided, you can check-in locally or through ePO and you will have the coverage against that.

Was my reply helpful?

If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[ALondo]

Is the ED available?

I had read, that mcafee security products already can detect HermeticWiper and protect the systems.

[AdithyanT]

Hi @ALondo,

Yes sir, you heard right. However, without a list of IOCs or hashes, we cannot be 100% sure of what samples we cover and we don't. If you are concerned about the specific samples listed here, we absolutely can ensure that you are protected from them via ENS.

Please do open an SR with us if you have any list of indicators that you wish to verify coverage with us and we will be happy to assist you with the same as well.

[AdithyanT · Accepted solution]

Hi @Marvin,

Our sincere apologies for the bad experience. We would like to assure you the following via this post:

--> The provided hashes are already covered via GTI/Artemis and currently covered via DAT as well, hence EXTRA DAT is no more needed.

--> This attack is being proactively researched by our Labs Team, hence, you will find tens and hundreds of IOCs belonging to this campaign alone being added to our database with every day signatures gaining detections on them and our GTI database updating itself every minute with newer detections on these indicators.

--> While It is an impossible task to post every single IOCs we have discovered in the wild with samples, you can always contact us with a Service request with a list of IOCS that you suspect may or may not be covered by us and we will provide you a confirmation on the coverage via the Service Request.

Apologies for any lack of clarity and sincerely looking forward to clarifying any further queries on this. I have personally taken up your Service Request and will ensure that your queries are answered ASAP.

[Nielsb]

Trellix Protections for the HermeticWiper Malware

Trellix is currently monitoring the latest wiper malware dubbed "HermeticWiper" that has been observed in attacks against the Ukraine. Trellix Global Threat Intelligence (GTI) is currently protecting against all known indicators associated with "HermeticWiper" and MVISION Insights will note detections in your environment as well.

https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/defenders-blog-on-cyberattacks-targ...

SNS notification:

==============================================================================

Hello,

Trellix is closely monitoring threat activity in Ukraine and signals of cyber-attacks globally. Our Threat Lab researchers are coordinating with government and industry partners to gain visibility into the evolving threat landscape. We are prepared if the cyber conflict extends beyond Ukraine by actors who attempt to take advantage of the world’s attention on this region to perpetrate their own malicious activity. We counsel vigilance in the spirit of #ShieldsUp and advise you to implement the latest measures to bolster your defenses.

Trellix continues to add protections to our products as new malware variants and behavior indicators are discovered. Throughout this crisis, we will provide research and analysis necessary to inform, prepare and address threats to your organization. Resources can be found in our Threat Center and publications analyzing newly discovered threats in our Trellix Labs blogs and @TrellixLabs Twitter handle.

Please contact us if you have any indication that you might be experiencing a cyber event. We stand with you shoulder to shoulder to help you work through this complicated time.

Thank you for your trust.

Trellix

============================================================================