![](\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2022\/12\/02055240\/crywiper-pseudo-ransomware-featured.jpg\"\/)
<\/p>\n<\/p>\n
Credit to Author: Editorial Team| Date: Fri, 02 Dec 2022 10:57:23 +0000<\/strong><\/p>\n Our experts have discovered an attack of a new Trojan, which they dubbed CryWiper. On the first glance, this malware acts as a ransomware: it modifies files, adds a .CRY extension to them, and saves a README.txt file with a ransom note, which contains the bitcoin wallet address, the contact e-mail address of the malware creators, and the infection ID. However, in fact, this malware is a wiper<\/a> \u2014 a file modified by CryWiper cannot be restored to its original state ever. So if you see a ransom note, and your files have a new .CRY extension, do not hurry to pay a ransom: it is pointless.<\/p>\n In the past, we have seen some malware strains that became wipers by accident \u2014 due to mistakes of their creators who poorly implemented encryption algorithms. However, this time it is not the case: our experts are confident that the main goal of the attackers is not financial gain, but destroying data. The files are not really encrypted; instead, the Trojan overwrites them with pseudo-randomly generated data.<\/p>\n The Trojan corrupts any data that is not vital for the functioning of the operating system. It doesn’t affect files with extensions .exe, .dll, .lnk, .sys, .msi, and ignores several system folders in the C:Windows directory. The malware focuses on databases, archives, and user documents.<\/p>\n So far, our experts have seen only pinpoint attacks on targets in the Russian Federation. However, as usual, no one can guarantee that the same code cannot be used against other targets.<\/p>\n In addition to directly overwriting the contents of files with garbage, CryWiper also does the following:<\/p>\n The purpose of the latter is not entirely clear. Perhaps this way malware authors tried to complicate the work of incident response team, that will clearly prefer to have a remote access to the affected machine \u2014 but instead they will have to get physical access to it. You can find technical details of the attack along with indicators of compromise in a post on Securelist<\/a> (in Russian only).<\/p>\n To protect your company’s computers from both ransomware and wipers, our experts recommend the following measures:<\/p>\nWhat CryWiper is hunting for<\/h2>\n
How the CryWiper Trojan works<\/h2>\n
\n
How to stay safe<\/h2>\n
\n