Malware Analysis Labs: Ukraine's Cyber Threat Intelligence Capacity

Malware analysis—the systematic examination of malicious software to understand its functionality, origin, and indicators of compromise—is fundamental to effective cyber threat intelligence. For Ukraine, which has been the target of Russian state-sponsored malware campaigns since at least 2014, malware analysis capability directly supports defensive operations: converting discovered malware samples into detection signatures, understanding attacker capabilities and intentions, and sharing intelligence with partners defending against the same threat actors. Ukraine's Computer Emergency Response Team (CERT-UA) has built significant malware analysis capability under wartime conditions, supported by international partnerships and growing domestic cybersecurity expertise.

CERT-UA Malware Analysis Operations

CERT-UA serves as Ukraine's primary national-level malware analysis organization, receiving samples from incident reports, partner sharing, and its own threat hunting activities. During the full-scale invasion, CERT-UA's publication rate of malware analyses and threat intelligence reports accelerated dramatically—the team published detailed analyses of dozens of campaigns, describing TTPs, indicators of compromise, and attribution assessments in remarkable detail given wartime conditions. These publications serve multiple purposes: warning Ukrainian organizations about active campaigns, providing detection content to defenders, and creating a public record that supports attribution accountability. CERT-UA's reports have become primary source material for global threat intelligence products from Microsoft, Google, Mandiant, ESET, and others, who correlate and enrich them with their own telemetry.

Malware Analysis Workflow

VirusTotal and Ukraine's Contribution to Global Threat Intelligence

VirusTotal, Google's cloud-based malware analysis service, serves as a critical platform for initial malware triage—samples submitted by Ukrainian security teams and organizations are scanned by 70+ antivirus engines and behavioral analysis systems, producing rapid multi-engine analysis. Ukraine-based submitters have been among the most prolific contributors of novel malware samples to the global analysis ecosystem during the conflict, as Russian cyber operations consistently produce previously unseen tooling. The intelligence value of Ukrainian submissions extends beyond identification: sample metadata (submission geography, associated file names, network connections observed in detonation) provides context for understanding campaign targeting, distribution methods, and infrastructure—context that helps build attacker profiles. Ukraine's security community has actively used VirusTotal's Graph tool to map relationships between malware samples, infrastructure, and threat actor clusters.

Reverse Engineering Capacity and Tools

Reverse engineering—analyzing compiled software to understand its logic without access to source code—is the core technical skill for malware analysis. Key tools include the NSA's open-source Ghidra disassembler (widely adopted by the global security research community after its 2019 open-source release) and the commercial IDA Pro disassembler. Binary Ninja and Hopper provide alternatives. Dynamic analysis environments include CAPE Sandbox (an evolved fork of Cuckoo Sandbox) that can deobfuscate packed malware through controlled execution. Ukraine's domestic cybersecurity firms—Infozakhyst, CyS Centrum, and others—maintain reverse engineering capabilities; academic programs at Ukraine's technical universities (KPI, Kharkiv Polytechnic) have contributed trained analysts who joined both CERT-UA and private sector security operations. Some reverse engineers have continued analytical work while also serving in territorial defense or military cyber units.

International Collaboration in Malware Analysis

Ukraine's malware analysis operations are deeply integrated with international partners. ESET, headquartered in Slovakia, maintains a dedicated Ukraine crisis research team and has been among the most significant contributors of joint analyses with CERT-UA—including the Industroyer2 discovery, HermeticWiper analysis, and numerous subsequent campaigns. Microsoft's Threat Intelligence Center (MSTIC) and Google's Threat Analysis Group (TAG) regularly correlate Ukrainian incidents with their visibility across cloud and endpoint telemetry. Mandiant (now part of Google) has embedded with Ukrainian defenders and published extensively on Russian APT operations targeting Ukraine. This collaborative ecosystem means that malware discovered in Ukraine often gets analyzed with substantially more resources than any single organization could deploy—multiple teams working in parallel on the same samples, producing richer attribution context and faster detection content development than the Ukrainian team could achieve alone.

FAQ

What is Ghidra?

Ghidra is a free and open-source reverse engineering tool developed by the National Security Agency (NSA) and released publicly in 2019. It provides disassembly, decompilation, and analysis capabilities for compiled software, enabling security researchers to understand malware functionality without access to source code. It is widely used in the global malware analysis community.

What is CAPE Sandbox?

CAPE Sandbox is an open-source malware analysis sandbox that automatically executes suspicious files in an isolated virtual environment, capturing behavior including file system changes, network connections, registry modifications, and API calls. It includes specialized capabilities for code injection analysis and automatic unpacking of obfuscated malware.

How does CERT-UA share threat intelligence?

CERT-UA publishes threat intelligence on its official website (cert.gov.ua) and shares structured intelligence through MISP (Malware Information Sharing Platform), which partners can connect to for machine-readable indicators of compromise. CERT-UA also coordinates with international partners through bilateral channels, ENISA networks, and the NATO Cooperative Cyber Defence Centre of Excellence.

What is MITRE ATT&CK, and why is it used in malware analysis reports?

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. Mapping malware capabilities to ATT&CK technique IDs (e.g., T1059 for command execution) provides a standardized language for describing attacker behavior that enables consistent comparison across reports and helps defenders prioritize detection content aligned with observed attacker methods.

How has the conflict improved Ukraine's malware analysis capacity?

The conflict accelerated Ukrainian malware analysis capacity through necessity and international support. The volume of novel malware requiring analysis required expanded teams and international collaboration. Western partners provided training, tools, and embedded support. The analytical output from this ecosystem, shared publicly through CERT-UA reports and partner publications, has established Ukrainian analysts as world-class contributors to the global threat intelligence community.

Sources

1. CERT-UA, Public Threat Intelligence Reports, 2022-2025 (cert.gov.ua)
2. ESET, "Ukraine Crisis: Threat Intelligence Compilation," 2022-2023
3. Microsoft Threat Intelligence, "Defending Ukraine: Early Lessons from the Cyber War," 2022
4. Mandiant, "APT44: Unearthing Sandworm," April 2024
5. Google TAG, "Ukraine and Ukrainian Cyber Threats Research," 2022-2023