Destructive malware wiper campaign targets Ukraine organizations
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
WhisperGate, HermeticWiper, IsaacWiper, HermeticWizard, and CaddyWiper wipers deployed against Ukraine since January 2022 to destroy systems.
In early 2022, Russian state-sponsored threat actors deployed multiple destructive malware variants against organizations in Ukraine preceding and during the invasion. WhisperGate, disclosed by Microsoft on January 15, corrupts the master boot record, displays a fake ransomware note, and encrypts files—but destroys data irreversibly rather than enabling recovery. HermeticWiper, disclosed February 23, similarly targets Windows systems by manipulating the master boot record to cause boot failure. IsaacWiper, HermeticWizard, and CaddyWiper were subsequently identified as part of the same campaign. These wipers propagate via compromised enterprise systems including patch management, remote assistance tools, antivirus platforms, administrative accounts, centralized file shares, and network devices. Unlike ransomware, the malware offers no recovery path even if ransom is paid, making containment and prevention critical.
CISA and FBI recommend immediate segmentation, access controls restricting administrative systems to least-privilege accounts, network monitoring for anomalous flows, staged patch deployment to minimize blast radius if patch systems are compromised, robust vulnerability management, and comprehensive recovery planning including offline backups and system documentation. Organizations should treat potential compromise of centralized infrastructure—patch managers, backup servers, network devices—as a distribution vector and isolate affected systems immediately upon detection.
Mentioned in this report
Detection guidance
Shadow Copy or Backup Catalog Deletion
Detects deletion of volume shadow copies or backup catalogs via vssadmin, wmic or wbadmin, a common step before destructive wiper activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shadow Copy or Backup Catalog Deletion
description: Detects commands that delete volume shadow copies, resize shadow storage
or delete backup catalogs and system state backups. Wiper operators remove recovery
options so that victims cannot restore data.
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: \vssadmin.exe
CommandLine|contains:
- delete shadows
- resize shadowstorage
selection_wmic:
Image|endswith: \wmic.exe
CommandLine|contains|all:
- shadowcopy
- delete
selection_wbadmin:
Image|endswith: \wbadmin.exe
CommandLine|contains:
- delete catalog
- delete systemstatebackup
- delete backup
condition: 1 of selection_*
falsepositives:
- Backup or storage administrators intentionally pruning shadow copies
- Disk cleanup scripts run by IT during maintenance
level: high
id: bcca6efa-74ae-5da7-89c4-e4566c2163d1
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-057a
Script Interpreter Direct Write to Physical Disk
Detects PowerShell or cmd command lines that reference a PhysicalDrive device together with write operations, indicating MBR overwrite or disk wipe attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Script Interpreter Direct Write to Physical Disk
description: Detects PowerShell or cmd command lines that address a raw PhysicalDrive
device together with write or copy primitives. This pattern indicates master boot
record overwrite or disk content wiping, as done by destructive wipers.
tags:
- attack.impact
- attack.t1561.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \cmd.exe
selection_device:
CommandLine|contains: PhysicalDrive
selection_write:
CommandLine|contains:
- WriteAllBytes
- FileStream
- Set-Content
- Out-File
- 'copy '
- 'dd '
- '> '
condition: all of selection_*
falsepositives:
- Disk imaging or forensic scripts run by administrators against physical drives
- Hardware diagnostic tooling that wraps cmd or PowerShell
level: high
id: c5a4b64d-cb0a-5e13-90ef-a24da0f04c77
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-057a
3 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-057a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs