Real 'Cyber War': Espionage, DDoS, Leaks, and Wipers in the Russian Invasion of Ukraine

Overview: Juan Andres Guerrero-Saade and Tom Hegel from SentinelLabs provide an on-the-ground analysis of cyber operations during the Russian invasion of Ukraine, challenging conventional Western assumptions regarding standalone "cyber warfare." Drawing on collaborative threat intelligence from CERT-UA, ESET, Mandiant, and Cisco Talos, the speakers detail the progression from pre-invasion positioning to active kinetic conflict. They examine the tactical roles of distributed denial-of-service (DDoS), hacktivism (e.g., Belarusian Cyber Partisans, Killnet), and dissect an unprecedented wave of destructive wipers and pseudo-ransomware deployed by Russian state actors such as Sandworm.

Key Topics: - Re-evaluating cyber war doctrine: cyber operations as integrated tactical support in combined-arms warfare - Threat actor attribution dynamics and the "telemetrical fog of war" across Ukrainian infrastructure - Hacktivism and information operations: Belarusian train disruption vs. pro-Russian DDoS and Conti ransomware leaks - Reverse engineering the wiper arsenal: HermeticWiper (FoxBlade), HermeticWizard, PartyTicket, IsaacWiper, DoubleZero, and DesertBlade

Technical Details: The presenters outline the timeline leading up to February 23–24, 2022, when destructive cyber operations accompanied the physical invasion. Russian state actors, prominently Sandworm (associated with UAC clusters), pre-positioned access via SMS phishing and Cyclops Blink malware before dropping HermeticWiper (tracked by Microsoft as FoxBlade) hours prior to ground incursions. Unlike NotPetya's uncontrolled self-propagation, HermeticWiper exhibited operational containment, spreading internally via Group Policy Objects (GPO) and scheduled tasks. To bypass Windows access control lists (ACLs) and overwrite raw disk sectors, partition tables, and Master Boot Records (MBR), HermeticWiper deployed signed, legitimate drivers from EaseUS Partition Master—mirroring the "Bring Your Own Driver" technique historically seen in Shamoon (EldoS RawDisk). HermeticWizard was subsequently identified as a separate, decoupled worm-like spreader module.

As the conflict unfolded, threat actors deployed a continuous succession of distinct wiper families reflecting a rapid, iterative "Fiverr mentality." PartyTicket was a Go-based pseudo-ransomware laced with inflammatory political strings targeting the White House; due to amateurish multi-threading and concurrency bugs, its encryption routine frequently pegged CPU utilization and failed before completing drive encryption. IsaacWiper (Lasraw), compiled as early as October 2021, used the Mersenne Twister pseudo-random number generator to systematically overwrite physical storage drives with random bytes. DoubleZero (FiberLake), uncovered by CERT-UA, was a heavily obfuscated .NET wiper designed to destroy files and system structures across hardcoded drive paths.

Later phases introduced DesertBlade, another Go-based destructive tool analyzed using the authors' AlphaGolang framework. DesertBlade abused Microsoft's winio and the hectane package to modify security descriptors and erase physical drives. The speakers emphasize that the apparent proliferation of wipers stemmed partly from an observer bias: in an active war zone, deep telemetry is scarce, and scorched-earth wiping represents the loudest, most visible cyber artifact compared to ongoing, clandestine espionage campaigns.

Key Takeaways: In military conflict, destructive cyber attacks function as tactical force multipliers designed to create confusion, delay communications, and destroy evidence rather than replace kinetic operations. Organizations facing state-sponsored threats must defend against "Bring Your Own Driver" (BYOVD) abuse by enforcing strict driver blocklists (such as Microsoft's vulnerable driver blocklist) and monitoring suspicious driver load events. Crucially, rapid intelligence sharing across international CERTs and commercial threat intelligence vendors proved vital for mitigating fast-moving wiper campaigns before wide-scale spillover occurred.

(AI summary — Gemini Flash)