CyberzSOC

GRU Unit 29155 cyber actors began deploying the destructive WhisperGate malware against multiple Ukrainian victim organizations as early as January 13, 2022. These cyber actors are separate from other known and more established GRU-affiliated cyber groups, such as Unit 26165 and especially for webmail, virtual private networks (VPNs), and accounts that access critical systems. This Cybersecurity Advisory provides tactics, techniques, and procedures (TTPs) associated with Unit 29155 cyber actors—both during and succeeding their deployment of WhisperGate against Ukraine—as well as further analysis (see Appendix A) of the WhisperGate malware initially published in the joint advisory, Destructive Malware Targeting Organizations in Ukraine, published February 26, 2022. FBI, CISA, NSA and the following partners are releasing this joint advisory as a collective assessment of Unit 29155 cyber operations since 2020: Justice)  Computer Emergency Response Team of Mission Force (CNMF)  Canadian Security Intelligence Service Security Service (MIVD)  Communications Security Establishment Service (BIS) Australian Cyber Security Centre (ASD’s of the Constitution (BfV)  United Kingdom National Cyber Security For additional information on Russian state-sponsored malicious cyber activity and related indictments, see the recent U.S.