Loading story…
Ukraine faced another wave of disruptive ransomware as researchers identified FakeCry, a WannaCry-lookalike campaign that primarily hit Ukrainian victims and appeared to overlap with infrastructure previously associated with M.E.Doc-linked outbreaks such as XData and NotPetya/Nyetya. The malware was not a true WannaCry clone: it used a separate dropper, required specific command-line arguments, relied on a Tor-based command-and-control server, and terminated processes before encrypting files in use, suggesting a more tailored operation than a commodity copycat attack.
A related regional campaign, Bad Rabbit, later struck organizations across Eastern Europe and Russia through compromised websites serving a fake Adobe Flash update, then spread internally using SMB, weak-credential brute forcing, mimikatz-like tooling, and the EternalRomance exploit associated with MS17-010. Cisco Talos reported that Bad Rabbit modified the Master Boot Record, used DiskCryptor-related components to encrypt disks and files, and shared a core codebase and similar build tooling with Nyetya, reinforcing concerns that multiple ransomware incidents in the region were closely connected in tradecraft even when presented as ordinary criminal extortion.
TTPs, infrastructure, and targeting history in one profile.
11 events from the most recent confirmed update back to the earliest known activity.
ESET reported that the October 24, 2017 campaign hit Kiev Metro, Odessa airport, Odessa naval port, and the Ukrainian ministries of infrastructure and finance, with additional victims reported in Russia and other countries. The company identified the malware as Diskcoder.D, a new Petya-family variant, and published preliminary details including Mimikatz use, hardcoded credentials, and IOCs tied to 1dnscontrol.com.
Talos reported that Bad Rabbit spread inside networks using SMB, weak credentials, mimikatz-like tooling, and the EternalRomance exploit, while requiring user interaction for initial infection. The researchers also assessed with high confidence that Bad Rabbit shared a core codebase and similar build tooling with Nyetya.
Talos assessed that the Bad Rabbit malware was active for approximately six hours before the 1dnscontrol[.]com distribution domain was taken down. This curtailed the initial drive-by delivery infrastructure used in the campaign.
Cisco Talos observed the Bad Rabbit ransomware campaign on October 24, 2017, with initial downloads seen around 08:22 UTC. The malware was distributed through compromised websites that redirected users to download a fake Adobe Flash Player installer.
The article states that the NotPetya outbreak began on Tuesday and places it after the start of the FakeCry campaign. It is also described as one of several Ukraine-focused ransomware operations tied by researchers to M.E.Doc update infrastructure.
According to MalwareHunter, the fourth ransomware campaign began on Monday, one day before the NotPetya outbreak. Most submitted samples appeared to come from Ukrainian victims, and the malware was designed to resemble WannaCry while differing substantially in code and behavior.
The references identify XData as an earlier ransomware campaign in Ukraine and place it in mid-May. The article later links it to the same broader cluster of Ukraine-focused ransomware activity.
BleepingComputer reported that a fourth ransomware campaign targeting Ukraine had been discovered, following XData, PSCrypt, and NotPetya. The report highlighted technical analysis from MalwareHunter and the apparent overlap with M.E.Doc-related infrastructure.
In response to the NotPetya-related allegations, M.E.Doc said it had not hosted trojanized versions of its applications. The company also said on Facebook that it had enlisted Cisco experts and invited Ukraine's Cyber Police to investigate its servers.
MalwareHunter identified a file path referencing M.E.Doc IS-pro software, suggesting the newly discovered ransomware may have been distributed through M.E.Doc-related infrastructure. The article notes uncertainty over whether this came from a trojanized update server or a compromised installation package.
PSCrypt is described as another Ukraine-focused ransomware campaign that occurred the week before NotPetya. It is cited as one of the earlier incidents preceding the newly discovered WannaCry-lookalike strain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourceblog.talosintelligence.com
Open sourcewired.com
Open sourcewelivesecurity.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Destructive malware operations against organizations in Ukraine included **CaddyWiper** and a separate pseudo-ransomware campaign that posed as extortion but was built to permanently destroy data. Researchers said CaddyWiper shared no code with earlier payloads such as **HermeticWiper**, but it similarly targeted user files, mapped drives, and disk partitions while avoiding execution on primary domain controllers through a domain-controller kill switch. U.S. authorities warned that multiple malware families were being used in coordinated attacks on Ukrainian networks, underscoring the risk of disruptive and irreversible data loss. Technical analysis showed the attacks relied on enterprise compromise and staged payload delivery rather than simple smash-and-grab deployment. CaddyWiper checked domain-controller status via the `DsRolePrimaryDomainInformation` API and wiped disks using low-level Windows functions, while defenders observed destructive payloads being pushed at scale through compromised **Group Policy Objects** after attackers obtained domain administrator access. In the pseudo-ransomware case, the intrusion chain used an MBR wiper, a downloader retrieving payloads from Discord CDN, a .NET loader that disabled Microsoft Defender and used process hollowing, and a final C-based wiper that overwrote files across 191 extensions before shutting systems down, leaving victims with no practical recovery path despite the ransom note.
Aug 15, 2026
Ukraine said Russia-linked threat groups intensified cyberattacks against its critical infrastructure, government, communications, energy, and humanitarian logistics networks, using phishing and multiple destructive malware families including **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, and **DoubleZero**. CERT-UA attributed activity during the period to several tracked clusters such as `UAC-0056`, `UAC-0051/UNC1151`, `UAC-0028/APT28`, and `UAC-0033/XDSpy`, and said the operations were tied to actors affiliated with Russian and Belarusian state structures and proxy entities. Ukrainian officials also reported targeting of organizations documenting war crimes and of European charities supporting refugees, underscoring that the campaign extended beyond domestic wartime targets. Researchers separately documented destructive intrusions in which **HermeticWiper** and **CaddyWiper** were deployed through Windows Group Policy after attackers had already gained broad control of victim networks. HermeticWiper hit finance organizations, government contractors, and other Ukrainian systems while also affecting some machines in Latvia and Lithuania; it corrupted local data and the master boot record, leaving devices unable to boot. In parallel, CERT-UA warned that phishing emails posing as antivirus updates delivered **Cobalt Strike** along with the **GraphSteel** and **GrimPlant** backdoors, a campaign linked with medium confidence to `UAC-0056`, showing that espionage, access operations, and destructive attacks were being conducted in tandem.
Aug 15, 2026
Kaspersky reported that several interconnected pro-Ukrainian hacktivist groups, including **4BID**, **Hacker kiт**, **C.A.S**, and **Goffee**, expanded attacks beyond Russia and Belarus to targets in **Kazakhstan, the UAE, Syria, and Egypt**. Victims included government entities, healthcare organizations, and the aviation sector. Researchers said the intrusions commonly began with exploitation of Microsoft Exchange **ProxyShell** vulnerabilities, followed by deployment of the `fd.aspx` ASP.NET web shell, execution of PowerShell or `cmd.exe`, reconnaissance, and installation of remote-management tools such as AnyDesk, Dev Tunnels, Panorama9, Tactical RMM, and Nezha Monitoring. The campaigns used a broad post-compromise toolkit that mixed public C2 frameworks and custom malware, including **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, **BlackSalt** backdoor, **Warp RAT**, **BlackReaperRAT**, **ClearWater** ransomware, and an updated **Blackout Locker**. Investigators also observed BYOVD-based EDR killers, including modified EDRKiller variants and GhostDriver, along with signs that some delivery scripts may have been AI-generated. ClearWater was seen encrypting files with **ChaCha20** and **RSA-2048**, dropping ransom notes, changing wallpapers, and deleting recovery artifacts, while Blackout Locker added a persistent screen-locking feature, reinforcing researchers' assessment that the actors are shifting from politically branded hacktivism toward financially motivated operations.
Jun 29, 2026