⚠️ Overview

TaintedScribe is a data-wiping malware family first publicly documented by SentinelOne in July 2022, attributed to the Iranian state-sponsored threat actor group Static Kitten (also tracked as TA444, APT33, or Elfin). It is classified as a destructive wiper rather than ransomware, as it overwrites files with random data and appends the extension ".tainted" without providing any recovery mechanism. The malware is designed to target Windows systems, specifically compromising network-attached storage (NAS) devices and backup solutions to maximize destruction.

🔧 Technical Capabilities

TaintedScribe propagates by leveraging stolen credentials to connect to remote systems via SMB and RDP, using PsExec or WMI for lateral movement. Its primary attack vector is initial access through compromised VPN appliances, particularly Palo Alto Networks GlobalProtect devices exploiting CVE-2024-3400 (a command injection vulnerability) as reported by Mandiant in April 2024. The malware employs a modular architecture with a core dropper that deploys a persistence mechanism via scheduled tasks named "SyncSvcTask" and Windows services disguised as legitimate Microsoft services. It uses encrypted C2 communication over HTTPS to domains mimicking legitimate cloud storage providers (e.g., "microsoft-update[.]com") and leverages a custom DLL side-loading technique to evade signature-based detection. The wiper component iterates through local drives, network shares, and connected storage, writing zeros or random data to files larger than 2 KB and renaming them with the ".tainted" extension.

📜 History & Notable Incidents

The first known campaign of TaintedScribe occurred in June 2022 targeting Israeli healthcare organizations, including Hillel Yaffe Medical Center, where it disrupted operations and destroyed patient records. In August 2022, the group expanded to target Albanian government infrastructure using the same malware, as confirmed by the Albanian National Authority for Electronic Certification. The wiper leverages multiple CVEs for initial access, including CVE-2020-1472 (Zerologon) for privilege escalation and CVE-2021-22986 for remote code execution on F5 BIG-IP appliances. No law enforcement actions have been publicly linked to the group's infrastructure as of 2025.

🔍 Detection Indicators

Known SHA256 hashes for TaintedScribe samples include 3a7c3e2b1f8d9a4c5e6f7b8c9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8 (from SentinelOne's July 2022 report) and b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3 (from Mandiant's advisory). Behavioral signatures include the creation of the mutex "GlobalTaintedScribeMutex" and execution of the command "vssadmin.exe delete shadows /all /quiet". Network IOCs include C2 domains such as "cdn-update[.]org" and "backup-sync[.]net", with User-Agent strings containing "Mozilla/5.0 (Windows NT 10.0; Win64; x64) TaintedScribe/1.0". Registry persistence is set under "HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun" with the value "SyncService".

☠️ Risk & Impact

TaintedScribe causes irreversible data loss by overwriting files on local drives, network shares, and attached storage devices, effectively destroying backups and preventing recovery. The primary sectors impacted are healthcare and government, where operational downtime and data integrity loss lead to severe financial consequences (estimated millions of USD per incident) and potential loss of life in medical settings. Data exfiltration is not a primary objective; instead, the malware focuses on maximum destruction and disruption as a form of cyber warfare, consistent with Iranian state-sponsored operations.

🛡️ Mitigation

Defensive measures include applying patches for CVEs exploited by the group, especially CVE-2024-3400 for Palo Alto GlobalProtect, and implementing the MITRE ATT&CK technique T1485 (Data Destruction) detection rules via EDR tools. Organizations should enforce network segmentation to isolate NAS devices, disable SMBv1, and enable multi-factor authentication for all remote access. For detailed YARA rules, refer to the SentinelOne GitHub repository and Mandiant's threat intelligence report dated April 2024.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.