Recently, we have seen several malware campaigns attacking Ukrainian organizations — Operation Bleeding Bear is a recent one of note. Elastic Security researchers recently verified a data wiper malware campaign that is targeting Ukrainian systems. As this malware campaign is new, with more information being uncovered hourly, it is being referred to as HERMETICWIPER.

Readers Note : This is a summarized post of a detailed write up by the Elastic Security Intelligence and Analytics team. A deep dive on UAC Bypass is available to read here.