Kaspersky Analyzes 'Synapse,' a New Wiper Malware Masquerading as Ransomware

Executive Summary

Researchers from Kaspersky's Global Research and Analysis Team (GReAT) have published a report on a new destructive malware named Synapse. This malware employs a deceptive strategy, masquerading as ransomware while its true function is to act as a wiper, causing irreversible damage to infected systems. Synapse drops a fake ransom note to trick victims and delay proper incident response, but its core function is to destroy the Master Boot Record (MBR) and corrupt files beyond recovery. The investigation noted code similarities between Synapse and malware historically linked to the Sandworm APT group, suggesting a potentially state-sponsored origin.

Threat Overview

Synapse represents a dangerous evolution in destructive attacks, blending the psychological tactics of ransomware with the purely destructive intent of a wiper.

• Deception Tactic: The malware's most notable feature is its masquerade. It encrypts a small number of insignificant files and drops a ransom note. This is designed to make the victim believe they are dealing with a typical financially motivated ransomware attack. This misdirection can cause victims to waste valuable time attempting to negotiate or procure cryptocurrency, while the real damage is being done.
• Destructive Payload: The true purpose of Synapse is data destruction. Its primary payload targets critical system components:
  • Master Boot Record (MBR): It overwrites the MBR, which is essential for the operating system to boot. This renders the system unbootable.
  • File System Corruption: It systematically overwrites the headers of files with junk data, making file recovery from the disk practically impossible.
• Initial Access: In the incident analyzed by Kaspersky, the initial vector was a compromised third-party software update, indicating a potential supply chain attack.

Technical Analysis

The dual-nature of Synapse is its key technical feature. The 'ransomware' component is a lightweight decoy, while the wiper component is the true payload. This separation of concerns suggests a deliberate and thoughtful design.

The fake ransom note and superficial encryption are carefully crafted to be convincing. However, Kaspersky's analysis confirmed that the 'encryption key' in the note is a decoy, and there is no corresponding decryption logic or C2 infrastructure for payment.

The code overlaps with the Sandworm toolkit are significant. Sandworm, a group attributed to Russia's GRU, is notorious for destructive attacks, including the NotPetya wiper outbreak in 2017, which also masqueraded as ransomware. While attribution is not definitive, the TTPs and code artifacts strongly point towards a sophisticated state actor with experience in destructive operations.

MITRE ATT&CK TTPs

• Initial Access: T1195.002 - Compromise Software Supply Chain - The reported vector was a compromised software update.
• Execution: T1204.002 - Malicious File - Execution of the trojanized software update.
• Defense Evasion: T1562.001 - Inhibit System Recovery - The wiper functionality is a form of inhibiting system recovery.
• Defense Evasion: T1027 - Obfuscated Files or Information - The malware likely uses obfuscation to hide its true intent.
• Impact: T1561.001 - Disk Content Wipe - Overwriting file headers with junk data.
• Impact: T1561.002 - Disk Structure Wipe - Destroying the Master Boot Record (MBR).
• Impact: T1485 - Data Destruction - The ultimate goal of the malware.

Impact Assessment

The impact of a Synapse attack is total and irreversible data loss on the affected systems. Unlike ransomware, there is no option for recovery through payment.

• Operational Disruption: The destruction of critical systems can cause a complete and prolonged shutdown of business operations.
• High Recovery Costs: Recovery is only possible if the organization has robust, air-gapped, and immutable backups. All affected systems must be rebuilt from scratch.
• Psychological Impact: The deception tactic adds a layer of psychological manipulation, causing confusion and potentially leading to poor decision-making during the initial stages of incident response.

Detection & Response

• Detection:
  • Detecting wipers before they execute is challenging. Behavioral-based EDR solutions may be able to detect the low-level disk writing activity associated with MBR and file header manipulation. Use D3FEND's Process Analysis.
  • Monitor for any unauthorized software update processes or connections to unknown update servers.
  • If a 'ransom note' appears, incident responders should not automatically assume it's a standard ransomware case. The possibility of a wiper must be considered, and analysis of the malware should be prioritized.
• Response:
  • Immediate Isolation: If a wiper is suspected, the immediate priority is to isolate affected and potentially affected systems to prevent its spread. This may involve taking entire network segments offline.
  • Do Not Trust the Note: Treat any ransom note with skepticism until malware analysis can confirm whether it is a true ransomware or a wiper.
  • Activate Disaster Recovery: If data is confirmed to be destroyed, the focus shifts from incident response to disaster recovery, relying on backups to restore operations.

Mitigation

• Immutable Backups: This is the single most critical defense against wipers. Maintain multiple copies of critical data, with at least one copy being offline, air-gapped, and/or immutable. Regularly test the restoration process.
• Application Control: Use application allow-listing to prevent unauthorized software (like a trojanized update) from executing.
• Supply Chain Security: Scrutinize the security practices of all third-party software vendors. Verify the integrity and authenticity of all software updates before deployment.
• Network Segmentation: Segment networks to contain the spread of a destructive payload. Critical systems should be isolated to limit the blast radius of an attack.