Threats Feed

The report details a malware resembling the infamous wiper used in the 2012 Iranian cyber incidents, though it's identified as a copycat rather than the original. It destroys data by wiping the Master Boot Record (MBR) using a signed disk driver. The malware encrypts its resources to avoid detection and collects information about potentially important files on infected systems for targeted destruction. Despite similarities to past cyberattacks, its use of different service names and wiping patterns, along with the lack of financial motives, suggests the involvement of "script kiddies" rather than sophisticated cybercriminals. The exact origin or purpose, including targeted countries or sectors, remains unspecified.