Threat Roundup: Lotus Wiper Targeting Energy Sector and Emerging Mobile Spyware

---
title: Potential Waper Activity - VSS Shadow Copy Deletion
id: 8a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to delete Volume Shadow Copies, a common precursor to wiper attacks to prevent recovery.
references:
  - https://securityaffairs.com/191312/malware/security-affairs-malware-newsletter-round-94.html
author: Security Arsenal
date: 2024/06/01
tags:
  - attack.impact
  - attack.t1485
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wbadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'delete backup'
  condition: selection
falsepositives:
  - Legitimate system administration tasks (rare)
level: high
---
title: Potential Waper Activity - Boot Configuration Modification
id: 9b3c4d5e-6f7a-5b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects modifications to boot configuration or recovery agents often used by wipers to prevent system restoration.
references:
  - https://securityaffairs.com/191312/malware/security-affairs-malware-newsletter-round-94.html
author: Security Arsenal
date: 2024/06/01
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\bcdedit.exe'
      - '\reagentc.exe'
    CommandLine|contains:
      - '/delete'
      - '/disable'
  condition: selection
falsepositives:
  - Authorized IT maintenance
level: medium
---
title: Potential Waper Activity - Mass File Encryption or Overwrite
id: 0c4d5e6f-7a8b-6c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects rapid file modifications or overwrites indicative of wiper behavior, often using tools like cipher or sdelete.
references:
  - https://securityaffairs.com/191312/malware/security-affairs-malware-newsletter-round-94.html
author: Security Arsenal
date: 2024/06/01
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\cipher.exe'
      - '\sdelete.exe'
  selection_params:
    CommandLine|contains:
      - '/w'
      - '-p 3'
  condition: 1 of selection*
falsepositives:
  - Legitimate disk wiping routines during hardware decommissioning
level: high

let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
// Identify execution of system administration tools used for destruction
| where FileName in~ ("vssadmin.exe", "wbadmin.exe", "bcdedit.exe", "cipher.exe")
| extend CommandArgs = tostring(ProcessCommandLine)
// Filter for destructive arguments
| where CommandArgs contains "delete" 
   or CommandArgs contains "/disable" 
   or CommandArgs contains "/w"
| project Timestamp, DeviceName, AccountName, FileName, CommandArgs, InitiatingProcessFileName
| order by Timestamp desc

-- Hunt for active wiper-related processes
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'vssadmin.exe'
   OR Name =~ 'wbadmin.exe'
   OR Name =~ 'cipher.exe'
   OR Name =~ 'bcdedit.exe'

-- Hunt for evidence of deleted VSS copies in recent event logs
SELECT System.TimeCreated, EventData, Message
FROM parse_xml(xpath=concat('//Event[', 
  'System[EventID=1 or EventID=4688]', 
  ']'))
WHERE Message =~ 'delete'
  AND Message =~ 'shadows'

# Validate and Enable Critical Recovery Services for Wiper Resilience
Write-Host "[+] Checking Volume Shadow Copy Service (VSS) Status..." -ForegroundColor Cyan
$vssService = Get-Service -Name VSS -ErrorAction SilentlyContinue

if ($vssService.Status -ne 'Running') {
    Write-Host "[!] WARNING: VSS Service is not running. Attempting to start..." -ForegroundColor Red
    try {
        Start-Service -Name VSS -ErrorAction Stop
        Write-Host "[+] VSS Service started successfully." -ForegroundColor Green
    } catch {
        Write-Host "[-] Failed to start VSS Service. Manual intervention required." -ForegroundColor Red
    }
} else {
    Write-Host "[+] VSS Service is Running." -ForegroundColor Green
}

# Check WinRE (Windows Recovery Environment) Configuration
Write-Host "[+] Checking Windows Recovery Environment (WinRE) status..." -ForegroundColor Cyan
try {
    $reAgentStatus = reagentc /info
    # Parse output to check if Windows RE is enabled
    if ($reAgentStatus -match "Windows RE status:\s*Enabled") {
        Write-Host "[+] Windows Recovery Environment is Enabled." -ForegroundColor Green
    } else {
        Write-Host "[!] WARNING: Windows RE is Disabled. Enabling..." -ForegroundColor Red
        reagentc /enable
    }
} catch {
    Write-Host "[-] Error checking WinRE status." -ForegroundColor Red
}

Write-Host "[+] Remediation check complete. Verify offline backups immediately." -ForegroundColor Cyan