New Iran-Linked Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East

guest · Dec 4, 2019

New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East
December 4, 2019
https://securityintelligence.com/po...are-targets-energy-sector-in-the-middle-east/

IBM X-Force has been researching and tracking destructive malware in the Middle East for some time now, particularly in the industrial and energy sectors.
In a recent analysis, X-Force Incident Response and Intelligence Services (IRIS) discovered new malware from the wiper class, used in a destructive attack in the Middle East. We named this malware “ZeroCleare” per the program database (PDB) pathname of its binary file.

According to our investigation, ZeroCleare was used to execute a destructive attack that affected organizations in the energy and industrial sectors in the Middle East. Based on the analysis of the malware and the attackers’ behavior, we suspect Iran-based nation-state adversaries were involved to develop and deploy this new wiper.
Click to expand...

Since ZeroCleare relies on the EldoS RawDisk driver, which is not a signed driver and would therefore not run by default, the attackers use an intermediary file named soy.exe to perform the workaround. They load a vulnerable but signed VBoxDrv driver, which the DSE accepts and runs, and then exploit it to load the unsigned driver, thereby avoiding DSE rejection of the EldoS driver.
Once loaded, the vulnerable VBoxDrv driver is exploited to run shellcode on the kernel level
Click to expand...

SecurityWeek: Iran-Linked ZeroCleare Wiper Targets Energy, Industrial Sectors in Middle East

ZeroCleare is similar to the notorious Shamoon malware and it’s designed to overwrite the master boot record (MBR) and disk partitions of devices running Windows. Similar to Shamoon, ZeroCleare relies on the legitimate EldoS RawDisk tool to achieve its goal.

The company’s analysis of the malware revealed that ZeroCleare was likely the work of at least two Iran-based threat groups, including the one known as OilRig, APT34 and ITG13.
According to IBM, ZeroCleare can target both 32-bit and 64-bit Windows systems.
Click to expand...

Log in or Sign up

New Iran-Linked Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East

guest Guest

Log in or Sign up

New Iran-Linked Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East

guest Guest

Useful Searches