Following the news that The National Cyber Security Centre has issued new guidance urging UK organisations to bolster their defences following a series of cyber attacks in Ukraine, Raj Samani, Chief Scientist at Trellix, made the following comment:

“The use of pseudo ransomware is not necessarily novel, and in this case we are tracking the prevalence of the campaign to determine whether targeting is wider than just the Ukraine. Upon analysis, it would suggest that the campaign is indeed largely focused on organizations in the one country. We have to acknowledge that such actions in conjunction with the inability to pay infers a destructive campaign, or indeed one intended to spread fear. This campaign somewhat resembles NotPetya and WannaCry in its pseudo ransomware nature, but it is highly targeted rather than wormable. This places it more in the tradition of a wiper like Shamoon.”