ESET links the DynoWiper wiper malware to Sandworm

The Slovak security company ESET has analysed the malware used in the attack on Poland's power grid late last year. It concludes the malware is a wiper, which it has named DynoWiper, and links it with medium confidence to the Russia-aligned threat actor Sandworm based on both the code and the observed tradecraft. Polish authorities say the attack was detected and mitigated before it had any effect on power generation or distribution.

What this means for your organisation

The attribution is interesting, but the operational point is the malware category. A wiper is not built to make money, it is built to destroy. Negotiation strategy and insurance do not help; what decides the outcome is whether you can restore from backups the attacker could not reach. That the Polish side caught it in time is also a reminder that detection in OT environments is achievable.

Berigo recommends

• Verify that backups of critical systems exist offline or in immutable storage, and test restoration in practice.
• Measure how long full recovery of a production site actually takes, and present that figure to leadership.
• Establish detection in the OT network, not only in IT, with logging usable for investigation.
• Exercise a scenario where systems are destroyed rather than encrypted, with no option to pay your way out.

Source

• welivesecurity.com
• zetter-zeroday.com