The attribution story of WhisperGate: an academic perspective

The attribution story of WhisperGate: an academic perspective

Speakers: Alexander (Oleksandr) Adamov (Teacher, Malware Analysis Trainer, NioGuard, BTH, NURE); Anders Carlsson (Europol trainer, Digital Forensic Expert, Blekinge Institute of Technology)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=Hk4wwDmDG3Y

Overview

This talk, presented by Alexander Adamov and Anders Carlsson, delves into the complex and often controversial process of attributing sophisticated cyberattacks, using the WhisperGate campaign as a primary case study. WhisperGate, a series of destructive wiper attacks targeting Ukrainian government, financial, and critical infrastructure organizations, occurred just before and during the full-scale Russian invasion of Ukraine in early 2022. The speakers explore the evolution of attribution for this campaign, highlighting the challenges posed by differing vendor naming conventions, false flag operations, and the inherent uncertainty in linking cyber activity to specific state-sponsored groups.

The presentation emphasizes the journey from initial, tentative attributions by security vendors like Microsoft and ESET to the more definitive conclusions drawn from open-source intelligence (OSINT), legal indictments, and deep investigative journalism. A significant portion of the talk is dedicated to exploring both traditional and cutting-edge methods of attribution, including the application of Generative AI (GenAI). Adamov and Carlsson, leveraging their backgrounds in malware analysis, digital forensics, and military intelligence, provide a unique academic and practical perspective on identifying the perpetrators behind such high-stakes cyber warfare.

The talk is crucial for understanding the intricacies of state-sponsored cyber operations, particularly those linked to Russia's GRU. It underscores the importance of persistent, multi-faceted investigation and introduces emerging tools like GenAI as potential game-changers in the attribution landscape. For cybersecurity professionals, threat intelligence analysts, and policymakers, this analysis of WhisperGate offers valuable insights into the methodologies, challenges, and future directions of cyber threat attribution.

Background

▶ Watch: Introduction to WhisperGate and its GRU context (0:00)

The WhisperGate campaign represents a pivotal moment in cyber warfare, preceding and accompanying Russia's full-scale invasion of Ukraine in February 2022. This series of highly destructive cyberattacks targeted critical Ukrainian sectors, including government, finance, and infrastructure. The campaign was characterized by its multi-vector approach, initially manifesting as a false flag operation defacing government websites with messages falsely attributing the attacks to Polish hackers. This was quickly followed by two distinct cyber kill chains employing sophisticated file wipers and disk wipers designed to destroy data and render systems inoperable, thus crippling vital government and critical infrastructure.

Initial attribution efforts by major cybersecurity firms revealed the inherent complexities of identifying state-sponsored actors. Microsoft initially assigned a temporary ID, DEV-0586, attributing the activity to the Russian GRU based on commonalities with other operations and geopolitical context. ESET, days later, linked the wiper attacks to Sandworm (also known as Voodoo Bear), another GRU-subordinated group. CrowdStrike, in turn, noted similarities to Woodworm (Sandworm) but acknowledged differences, suggesting a potentially new GRU-linked entity. This early divergence in attribution, coupled with the use of temporary or overlapping group names, underscored a significant problem: the lack of a unified naming convention among security vendors, making it difficult to consistently track and communicate about threat actors.

Over time, more definitive evidence emerged. CrowdStrike’s Vice President of Threat Intelligence, Adam Meyers, officially attributed the WhisperGate attacks to Amber Bear, a Russian nexus threat actor, during congressional hearings. Microsoft later rebranded DEV-0586 to Cadet Blizzard. The most conclusive attribution, however, came from an indictment filed in a Maryland court in August 2024 (published September 2024), which specifically named individuals and identified Amber Bear as GRU Unit 25155. Further investigative journalism by "The Insider" and Christo Grozev, involving the alleged hijacking of the GRU unit's mail server, provided unprecedented detail into the unit's operations, personnel, and history since its establishment. This evolution of attribution, from vague temporary IDs to specific military units and individuals, highlights the challenges and eventual successes in unmasking state-sponsored cyber threats.

Key Findings

▶ Watch: Profiling Amber Bear: GRU Unit 29155 and its history (8:00)

The talk presents several key findings regarding the WhisperGate campaign and the broader landscape of cyber threat attribution. Foremost among these is the definitive attribution of WhisperGate to Amber Bear, specifically identified as GRU Unit 25155. This attribution evolved over time, starting with initial, somewhat ambiguous vendor reports that used temporary IDs (e.g., Microsoft's DEV-0586) or linked the activity to known GRU groups like Sandworm (Voodoo Bear). Through subsequent analysis, legal indictments, and investigative journalism, the specific GRU unit responsible for WhisperGate was unmasked, providing a comprehensive picture of the perpetrators, their structure, and their operational history.

A critical insight into Amber Bear (GRU Unit 25155) is its organizational structure and recruitment strategy. The unit reportedly comprises two distinct generations: older GRU officers with limited technical skills and a newer cohort of young, talented specialists recruited from military academies. These younger recruits are primarily responsible for developing the sophisticated malware used in operations like WhisperGate. This "two-generation" model explains how the unit, initially perceived to have limited IT skills before 2021, could execute advanced cyberattacks. This unit's primary objective is destabilization and sowing mistrust, aligning with its past involvement in high-profile incidents like the Salisbury assassinations and attacks on the World Anti-Doping Agency (WADA).

Another significant finding relates to the methodologies of attribution. The speakers emphasize the role of both manual human analysis and automated techniques. Manual analysis involves identifying shared Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs) across different campaigns. A notable TTP identified for Amber Bear was the use of Discord as a mechanism for malware propagation, where attachments were uploaded to Discord threads and then downloaded via its Content Distribution Network (CDN). This specific technique was observed in WhisperGate and later in an attack against Ukraine's energy sector. The analysis also revealed resource sharing between GRU units, such as Amber Bear's use of Saintbot (s.exe), a malware not developed by them but by another Russian nexus threat actor, Sand Bear.

Finally, the talk highlights the potential and pitfalls of using Artificial Intelligence for attribution. Traditional machine learning classifiers, when fed WhisperGate IOCs and TTPs, often erroneously attributed the campaign to Sandworm. However, when Generative AI (GenAI) models like ChatGPT were provided with full intelligence reports, including contextual information beyond mere IOCs, they achieved higher accuracy in attributing WhisperGate to Amber Bear. This demonstrates GenAI's capability to process unstructured data, extract nuanced indicators, and potentially overcome the limitations of traditional methods and the challenges posed by the lack of unified naming conventions among security vendors.

Technical Deep Dive

▶ Watch: Challenges in traditional threat actor attribution (12:00)

The WhisperGate campaign employed a multi-faceted approach, indicative of a sophisticated state-sponsored operation. The initial phase involved a false flag operation, defacing Ukrainian government websites, notably the Ministry of Education, with messages blaming "Polish hackers." This was a clear attempt to mislead investigators and sow discord.

The core of WhisperGate, however, lay in its destructive capabilities, delivered through two distinct cyber kill chains. The first utilized a file wiper, a malicious program designed to systematically corrupt or delete files on targeted systems. The second employed a disk wiper, which goes a step further by overwriting or destroying the master boot record (MBR) or partition tables, rendering entire disks unbootable and data irrecoverable. These wipers were deployed against critical government and infrastructure servers, aiming to cause maximum disruption and data loss.

Attribution efforts relied heavily on analyzing Indicators of Compromise (IOCs), Tactics, Techniques, and Procedures (TTPs), and metadata. A critical IOC observed was the deployment of the wipers across approximately 70 different Ukrainian organizations, with remarkably consistent compile times, often differing by less than seconds, regardless of geographical location (e.g., Kharkiv, Kyiv, Odesa, Lviv). This suggested a highly coordinated and automated deployment mechanism.

A distinctive TTP linking WhisperGate to Amber Bear's broader operations was the use of Discord for malware propagation. Attackers would upload malicious attachments, such as the GPX file wiper (an obfuscated file wiper), to Discord threads. These files could then be downloaded by victims via Discord's Content Distribution Network (CDN). This technique was also observed in a subsequent Amber Bear attack against Ukraine's energy sector in February 2022, reinforcing the attribution. Furthermore, analysis by CISA identified clusters of files uploaded to Discord, where WhisperGate components were found alongside s.exe, identified as Saintbot. While Saintbot is attributed to another Russian group, Sand Bear, its use by Amber Bear in their operations suggests either resource sharing between GRU units or a deliberate attempt at obfuscation.

The speakers also delved into the application of AI for attribution. Initially, traditional machine learning classifiers were tested. Algorithms fed with WhisperGate's IOCs and TTPs predominantly attributed the campaign to Sandworm (Voodoo Bear), another GRU unit known for destructive operations against Ukrainian energy infrastructure. However, a few algorithms, such as the Gaussian Naive Bayes, did point to Amber Bear. This highlights the challenge of distinguishing between closely related state-sponsored groups using similar tools or TTPs.

The breakthrough came with Generative AI (GenAI), specifically ChatGPT. When initially presented with only IOCs, ChatGPT also leaned towards Sandworm or other groups like APT29, Gamaredon, Wizard Spider, and even the North Korean Lazarus Group. However, a significant improvement was observed when the GenAI model was provided with full intelligence reports about Amber Bear's operations, rather than just extracted IOCs. By loading the entire report into the context window, ChatGPT was able to process the comprehensive narrative, contextual details, and nuanced connections, leading to a correct attribution of WhisperGate to Amber Bear. This demonstrates GenAI's capacity for linguistic analysis and extracting indicators from unstructured threat intelligence data, potentially enabling higher attribution accuracy and new methods for identifying threat actors, such as analyzing messages in threat actor-linked Telegram channels. This approach reduces the need for manual extraction and structuring of data, streamlining the attribution process.

Demo / Proof of Concept

▶ Watch: Applying Generative AI to threat actor attribution (19:00)

While the talk did not feature a live, interactive demonstration of an exploit or tool, it presented a compelling proof of concept for leveraging Generative AI (GenAI) in cyber threat attribution. The "demo" was an experimental application of ChatGPT to the WhisperGate case study, showcasing its capabilities and limitations.

The speakers described their methodology:

1. Initial Attempt with Traditional Data: They first uploaded a list of Indicators of Compromise (IOCs) from the WhisperGate campaign to ChatGPT. The results were mixed and often inaccurate, with ChatGPT attributing the campaign to various known threat actors, including Sandworm, APT29, Gamaredon, Wizard Spider, and even the North Korean Lazarus Group. This outcome mirrored the challenges faced by traditional machine learning classifiers, which often struggled to differentiate between closely related GRU units based solely on fragmented technical indicators.
2. Advanced Attempt with Contextual Data: Recognizing the limitations of isolated IOCs, the speakers then provided ChatGPT with a full intelligence report detailing Amber Bear's operations. This involved loading the entire unstructured report into ChatGPT's context window, allowing the AI to process a wealth of contextual information, narratives, and nuanced connections that are typically missed when only structured IOCs are provided.
3. Successful Attribution: With the comprehensive report, ChatGPT successfully and with high likelihood attributed WhisperGate to Amber Bear. This experiment demonstrated that GenAI, unlike traditional methods, can effectively extract and synthesize information from complex, unstructured intelligence reports, leading to more accurate attribution by understanding the broader operational context and TTPs.

This proof of concept highlights GenAI's potential to revolutionize threat intelligence by automating the analysis of vast amounts of textual data, identifying subtle patterns, and overcoming the challenges posed by inconsistent naming conventions and the need for manual data extraction. It suggests a future where AI-based personas could assist malware researchers and attribution specialists in complex investigations.

Defensive Implications

▶ Watch: The future role of AI in threat intelligence (20:00)

Understanding the attribution story of WhisperGate and the operational profile of Amber Bear (GRU Unit 25155) provides several critical defensive implications for organizations and national cybersecurity agencies.

1. Focus on TTPs, Not Just IOCs: Defenders must move beyond a reactive, IOC-centric approach. While IOCs are crucial for immediate detection, the talk emphasizes the importance of understanding and tracking Tactics, Techniques, and Procedures (TTPs). Amber Bear's consistent use of Discord for malware propagation, for instance, is a TTP that can be detected through network monitoring, egress filtering, and endpoint behavioral analysis. Organizations should implement robust controls to monitor and restrict access to untrusted cloud storage and communication platforms.
2. Beware of False Flags and Deception: The initial false flag operation in WhisperGate underscores the need for deep analytical capabilities that can discern genuine threats from deliberate misdirection. Defenders should be wary of self-attribution claims by attackers and conduct thorough forensic investigations to unearth the true origins of an attack. This requires skilled analysts capable of looking beyond surface-level indicators.
3. Strengthen Core Defenses Against Wipers: The destructive nature of WhisperGate's file and disk wipers highlights the paramount importance of robust backup and recovery strategies, network segmentation, and endpoint detection and response (EDR) solutions. Regular, immutable backups stored off-network are essential to mitigate the impact of data destruction. Network segmentation can contain the lateral movement of wipers, while EDR can detect and prevent their execution.
4. Stay Updated on Threat Actor Profiles and Naming Conventions: The confusion surrounding initial attributions (DEV-0586, Sandworm, Woodworm, Amber Bear, Cadet Blizzard) stresses the need for organizations to track threat actor intelligence from multiple sources. While a unified naming convention is ideal, defenders must be aware of the various aliases used by different vendors for the same group (e.g., GRU Unit 25155). This cross-referencing is vital for comprehensive threat intelligence.
5. Leverage AI for Threat Intelligence: The successful application of Generative AI (GenAI) in attributing WhisperGate suggests a powerful new tool for defenders. Organizations should explore integrating GenAI capabilities into their threat intelligence platforms to automate the extraction and synthesis of information from unstructured reports. This can improve the accuracy and speed of attribution, helping defenders anticipate and respond to threats more effectively.
6. Understand Adversary Recruitment and Evolution: The insight into Amber Bear's structure, with older officers and technically skilled young recruits, indicates that state-sponsored groups are continually evolving their capabilities. Defenders should anticipate increasingly sophisticated malware and TTPs. Continuous training for cybersecurity personnel and investment in advanced security technologies are necessary to counter this evolving threat landscape.
7. Participate in Information Sharing: The complex nature of state-sponsored attacks necessitates collaboration. Sharing threat intelligence, TTPs, and attribution insights with industry peers, government agencies, and international partners can enhance collective defense capabilities against groups like Amber Bear.

Key Takeaways

• Attribution is a Complex and Evolving Process: The WhisperGate case demonstrates that attribution for state-sponsored attacks is rarely immediate or straightforward, often involving initial uncertainty, conflicting vendor reports, and a gradual accumulation of evidence over time.
• Amber Bear (GRU Unit 25155) is a Sophisticated Threat: The GRU Unit 25155, responsible for WhisperGate, is a highly capable and destructive actor focused on destabilization, employing advanced wipers and deceptive tactics like false flags.
• Discord Was a Key Propagation Mechanism: Amber Bear consistently utilized Discord's CDN for malware distribution, a specific TTP that can serve as a strong indicator for their operations.
• Generative AI Holds Promise for Attribution: While traditional ML struggles with nuanced context, GenAI (e.g., ChatGPT) can achieve high attribution accuracy when provided with full, unstructured intelligence reports, offering a new frontier for threat intelligence.
• Unified Naming Conventions are Critically Needed: The proliferation of different threat actor names (DEV-0586, Cadet Blizzard, Sandworm, Amber Bear) by various security vendors hinders consistent tracking and communication among defenders.
• Defenders Must Focus on TTPs and Robust Resilience: Beyond IOCs, understanding adversary TTPs is crucial. Organizations must prioritize strong backup strategies, network segmentation, and advanced detection capabilities to mitigate the impact of destructive wipers.

About the Speaker(s)

Alexander (Oleksandr) Adamov is a distinguished educator and expert in malware analysis. He serves as a Teacher and Malware Analysis Trainer at NioGuard, Blekinge Institute of Technology (BTH), and NURE. With 15 years of experience, he teaches how to analyze malware and is the founder of a malware analysis research laboratory. His academic work often involves exploring new methodologies, including the application of AI in cybersecurity.

Anders Carlsson is a highly experienced digital forensic expert and trainer. He is an Europol trainer and a Digital Forensic Expert at Blekinge Institute of Technology. A former submarine officer, Carlsson holds a military PhD and has a long history of working with Ukraine, deploying advanced malware analysis courses since 2012 and assisting with infrastructure attacks since 2014. His expertise bridges military intelligence, forensics, and academic research.