Data-Destruction Attack Targeted Few Select Iranian Computers

Simplistic data-destroying malware found on small number of targeted computers in Iran

Its no Stuxnet or Wiper, but the latest data-destroying malware targeting specific computers in Iran still wreaks some serious damage.
Irans CERT
on Sunday first issued an alert
about the relatively rudimentary malware, which was discovered to delete data off of various drives at specific times and dates. The malware is a very simple knockoff of other wiping malware with no relation to those previously discovered malware attacks, and very few machines were infected by it, according to the CERT.
Researchers from Symantec, Kaspersky Lab, AlienVault Labs, and SophosLabs all have studied a sample of the malware, a.k.a. Batchwiper or GrooveMonitor. They concur that its a simplistic yet lethal piece of malware that doesnt appear to be related to the nation-state built Stuxnet and Wiper that hit Irans nuclear facility, or the destructive Shamoon that wiped 30,000 workstations of their data at Saudi Aramco, and deleted files at the Iranian oil ministry.
Its the latest in a series of data-destroying malware attacks targeting specific organizations in the Middle East. This return to 1980s and early-90s malware that damages or deletes data puzzles researchers. Its not the kind of thing youd expect a nation-state [to create], says Chester Wisniewski, a senior security adviser for
Sophos
.
He says its odd that Iran sounded the alarm about such an unsophisticated attack. This [malware] is something anybody could have done, he says.
Batchwiper/GrooveMonitor uses a DOS BAT file that was converted to a Windows Portable executable file. It wipes data off of drivers lettered D through I, as well as files on the users desktop, and is set to do its dirty deed during specific dates, including between Dec. 10 and 12, and Jan. 21 and 23, as well as various dates that run through 2015.
Thats not something we see almost ever, Wisniewski says. Its one of the few things that suggests that its a targeted attack. Its very weird: Why would you care if its Dec. 12? What those dates mean is a mystery.
The author of the malware even made an obvious typo in the code that prevents one feature from functioning. SophosLabs found a second variant of the malware, but its still the same basic code.
Kaspersky Lab also saw an error in the code. Other than the geographic region there doesnt seem to be any commonality with this file-deleting malware and the previous attacks weve seen. Even though the code is extremely simplistic it looks like the author managed to slip in a mistake, by not deleting a line of old code, says Roel Schouwenberg, senior researcher for global research and analysis at Kaspersky Lab, in
a blog post
.
Just how it spread is unclear. Jaime Blasco, labs manager at AlienVault Labs, thinks it may be via USB. We don’t have details about the infection vector but based on the dropper it could be deployed using USB drives, internal actors, SpearPhishing or probably as the second stage of a targeted intrusion, Blasco
says in a blog post
.
The Iranian CERT initially reported that the malware was efficient yet simple, and was wiping out disk partitions and user profile directories without being detected by antivirus software.
This is as basic as it gets. But if it was effective, that doesnt matter. If it wasnt clear already -- the era of cybersabotage has arrived. Be prepared, Schouwenberg says.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Data-Destruction Attack Targeted Few Select Iranian Computers