Microsoft discovers FoxBlade malicious software on Ukrainian systems

Microsoft claims it has discovered an entirely new malware program -called "FoxBlade" -- just hours before Russia began its incursion into Ukraine on the 24th of February.

In an article on the blog, Microsoft president Brad Smith declared that it is working in coordination to safeguard users in Ukraine together with the Ukrainian government and The European Union, European nations and NATO, as well as NATO, the US administration, NATO, and the United Nations.


"Several hours prior to the firing of missiles, or the movement of tanks on the 24th of February Microsoft's Threat Intelligence Center (MSTIC) discovered a new wave of destructive and offensive cyberattacks targeted at Ukraine's digital infrastructure. We immediately notified the Ukrainian government of the issue which included our identification of the new malware program (which we identified as FoxBlade) and gave the technical details on how to stop the malware's spread," Smith said.

"In the last few days we've provided threats intelligence and defensive tips in recent days to Ukrainian official... This is a process that is ongoing."

Smith said that the cyberattacks targeting Ukraine that were reported by Microsoft are extremely focused and not as extensive like the 2017 NotPetya attack.

However, Smith stated that Microsoft has witnessed recent cyberattacks against "Ukrainian civilian cyber-attacks, such as the agriculture sector, financial sector as well as emergency response services, humanitarian aid, as well as energy sector enterprises and organizations."

Microsoft has also informed the Ukrainian government of efforts to take data from government sources, such as information about health, insurance information transport data, as well as other information that can be identified as personal to you.

Alongside Microsoft's efforts to assist Ukraine through security steps, Microsoft said it is also taking steps "to lessen the visibility of Russian propaganda of the state as well as to ensure our own platforms don't accidentally fund these activities."

"In keeping to the EU's recent decision that was issued, it has been decided that the Microsoft Start platform (including MSN.com) will not show any state-sponsored RT or Sputnik content. We have decided to remove RT news applications off Our Windows app store, and also reduce the ranking of these websites the results of searches on Bing to ensure that it will only show RT and Sputnik hyperlinks when the user has a clear intention to navigate to these pages," Smith said.

"Finally we're banning all ads from RT and Sputnik on our ad network. We we will not display any advertisements from our ad network these websites.'

"We are also committed as a business on defending against state-sponsored disinformation efforts which have been commonplace during times of conflict. The last few days have witnessed the use of kinetic warfare, which is accompanied by an organized battle going on within the world of information in which the weapon is disinformation, which is destroying truth and planting seeds of division and suspicion. This is the reason we need to take decisive action in the technology sector as a company, both on its own as well as in collaboration with other companies and with academics, government agencies and the civil world."

Smith said Smith added that Microsoft collaborates together with International Committee of the Red Cross (ICRC) as well as other UN agencies to support refugee efforts.