# Operation Bleeding Bear

WhisperGate destructive malware overwrote the MBR of Ukrainian government machines via WriteFile to PhysicalDrive0, rendering hosts unbootable and corrupting files.

- Payout: Real-world hack
- Severity: high
- Program: Ukrainian government entities
- Analysis by: Daniel Stepanic, James Spiteri, Joe Desimone, Mark Mager, Andrew Pease
- Disclosed: 2022-12-06
- Write-up quality: 6/10
- Original: https://www.elastic.co/security-labs/threat-command/operation-bleeding-bear
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-operation-bleeding-bear
- Tags: area:os domain:desktop impact:dos impact:integrity kind:incident platform:threat-intel sev:high tech:windows technique:chained technique:source-review vuln:dos vuln:misconfiguration

**Target:** Windows endpoint Master Boot Record (PhysicalDrive0) and local files
**Root cause:** Stage1.exe opens a handle to the first physical drive (the MBR) with CreateFileW and calls WriteFile with 512 bytes from an 8192-byte stack buffer containing attacker MBR data, overwriting the boot record.
**Steps:**
1. Stage1.exe allocates an 8192-byte stack buffer holding new MBR data including the ransom note
2. `CreateFileW` obtains a handle to the first physical drive representing the MBR
3. `WriteFile` writes only 512 bytes from the buffer over the Master Boot Record
4. On next boot the tampered MBR renders the host inoperable, displaying the ransom note
5. Stage2.exe downloads an obfuscated .NET payload from Discord CDN and executes it in memory
6. Stage3 writes/executes a VBS script and runs `powershell.exe Set-MpPreference -ExclusionPath 'C:\'`
7. AdvancedRun is dropped and used to run `sc.exe stop WinDefend` and `rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse`
8. InstallUtil.exe is copied to %TEMP% and launched suspended; VirtualAllocEx/WriteProcessMemory/SetThreadContext/ResumeThread hollow it with the file corruptor
9. File corruptor overwrites targeted extensions with 1MB of 0xCC, renames files to random extensions, then self-deletes via `cmd.exe /min /C ping 111.111.111.111 -n 5 -w 10 > Nul & Del /f /q <path>`
**How found:** Elastic analyzed the reported campaign components, noting the low-complexity stage1 binary's CreateFileW/WriteFile sequence against PhysicalDrive0 as the MBR-wipe signal, and built behavioral MBR protection around the prewrite buffer.
**Exploitation:** Multi-stage chain: stage1 wipes the MBR to brick the host; stage2 pulls a payload from Discord CDN; stage3 disables Windows Defender via exclusion path, service stop and directory deletion, then process-hollows InstallUtil.exe to run a file corruptor that destroys documents across local, USB and network drives. No decryption intent; single shared Bitcoin address.
**Escalation:** Chained MBR wiper with Defender tampering and a file corruptor to maximize destruction across attached and network storage.
**Insight:** MBR wipers are detectable behaviorally: monitor WriteFile to \\.\PhysicalDrive0 and inspect the prewrite buffer (Base64 ransom note) rather than relying on static hashes, since the payload is trivial and easily recompiled.

## Proof of concept (copied exactly from the original report)

**AdvancedRun command stopping Windows Defender**

```
"C:\Users\jim\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" `
 /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
```

**AdvancedRun deleting Windows Defender directory**

```
"C:\Users\jim\AppData\Local\Temp\AdvancedRun.exe" `
 /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 `
 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" `
```

**Hunting query for InstallUtil code injection**

```
process where event.type == "start" and
process.pe.original_file_name == "InstallUtil.exe" and
not process.executable : "?:\\Windows\\Microsoft.NET\\*"
```