Threat Intel
Operation Bleeding Bear: MBR‑Wiping Malware Targeting Ukrainian Entities
A multi‑stage destructive campaign, Operation Bleeding Bear, targeted Ukrainian government and private organizations in January 2022. The malware overwrites the Master Boot Record and corrupts critical files without demanding ransom. Defenders should enable Elastic Security’s EDR and Ransomware Protection modules and monitor for MBR write attempts.
What happened
In mid‑January 2022, a multi‑stage campaign dubbed “Operation Bleeding Bear” hit Ukrainian government and private organizations. The attackers deployed WhisperGate, a malware bundle that first overwrites the Master Boot Record (MBR) to render systems inoperable, then injects a file‑corruptor that damages specific directories.
Impact
Machines infected with the MBR payload cannot boot, effectively wiping the OS. The file infector targets extensions such as .docx, .xlsx, and .pdf, rendering critical documents unusable. No ransom is demanded; the same Bitcoin address is used for every victim, indicating a purely destructive intent.
Detection & Prevention
Elastic Security’s endpoint detection and response (EDR) automatically flags the following behaviors:
- Process hollowing and injection into system services
- WriteFile calls to \\\\.PHYSICALDRIVE0 (MBR modification)
- Disabling or tampering with Windows Defender
- Execution of a 8192‑byte buffer that writes 512 bytes to the boot sector
These signatures are included in the platform’s built‑in malware library. Enabling the Ransomware Protection module and ensuring that Windows Defender is not disabled will block the attack before the MBR is altered.
Recommended Actions
- Verify that Windows Defender is enabled and not being disabled by third‑party software.
- Deploy Elastic Security’s latest EDR policy set; it contains the WhisperGate detection rules.
- Monitor for MBR write attempts and process injection events.
- Keep backups on separate media and test restoration after a simulated MBR wipe.
What to do if infected
Because the MBR is overwritten, recovery requires a clean OS reinstall and restoration from a known good backup. Do not attempt to boot from the affected disk. Use a live USB or another machine to recover data from the unmodified partitions.
Related articles
Chinese Espionage Group Deploys New SparroWocky Backdoor in Latin America
FamousSparrow, a China‑linked threat actor, has moved beyond its old SparrowDoor tool and rolled out the modular C++ backdoor SparroWocky against government entities across Latin America. The malware uses sophisticated anti‑analysis tricks—DLL side‑loading, RC4‑encoded payloads, dynamic API resolution, and CreateThread hooking—to evade detection. It can execute commands, exfiltrate data, capture high‑frequency screenshots, proxy traffic, and even wipe its own traces. ESET’s analysis pinpoints 18 C2 endpoints and shows the operation has been active for over a year, targeting Argentina, Ecuador,
Read briefing
Russian Drone Strikes Damage Kyiv Data Centers and Disrupt Regional ISP Connectivity
Recent Russian drone and missile strikes targeting Kyiv damaged local data centers and telecommunications infrastructure, causing partial connectivity losses for at least four major Ukrainian internet service providers. The outages impacted approximately 100,000 households and disrupted critical civilian communications systems, prompting emergency repair operations.
Read briefing
N0va Phishkit Campaign Targets US & EU Businesses via Legitimate SSO Abuse
A new phishing operation, dubbed N0va Phishkit, has been observed targeting organizations in North America and Europe. Attackers mimic trusted services and hijack legitimate authentication flows to harvest access and refresh tokens, granting attackers SSO access to corporate resources. Defenders should monitor for anomalous authentication requests, enforce MFA, and review token usage.
Read briefing
ClearFake Campaign Uses WebDAV and Fake CAPTCHA Lures to Deploy Amatera Stealer
Cybersecurity researchers have uncovered a new ClearFake infection campaign that leverages fake Google CAPTCHA prompts and WebDAV shares to distribute the Amatera information stealer. The multi-stage attack tricks users into running malicious commands, resulting in the deployment of secondary payloads such as ZigCryptoStealer, a Go-based reverse proxy, and unauthorized instances of NetSupport Manager. Activity targeting a Ukrainian government organization has been linked to a threat cluster tracked as UAT-10820.
Read briefing