# Destructive malware wiper campaign targets Ukraine organizations

Published: 2025-06-20 · Severity: routine · Sectors: government-national, energy, financial-services, healthcare, technology, telecommunications, infrastructure
Canonical: https://vorant.io/reports/1ded53da-438c-52e0-9d60-1f5764b0ebb2/destructive-malware-wiper-campaign-targets-ukraine-organizations

> WhisperGate, HermeticWiper, IsaacWiper, HermeticWizard, and CaddyWiper wipers deployed against Ukraine since January 2022 to destroy systems.

In early 2022, Russian state-sponsored threat actors deployed multiple destructive malware variants against organizations in Ukraine preceding and during the invasion. WhisperGate, disclosed by Microsoft on January 15, corrupts the master boot record, displays a fake ransomware note, and encrypts files—but destroys data irreversibly rather than enabling recovery. HermeticWiper, disclosed February 23, similarly targets Windows systems by manipulating the master boot record to cause boot failure. IsaacWiper, HermeticWizard, and CaddyWiper were subsequently identified as part of the same campaign. These wipers propagate via compromised enterprise systems including patch management, remote assistance tools, antivirus platforms, administrative accounts, centralized file shares, and network devices. Unlike ransomware, the malware offers no recovery path even if ransom is paid, making containment and prevention critical.

CISA and FBI recommend immediate segmentation, access controls restricting administrative systems to least-privilege accounts, network monitoring for anomalous flows, staged patch deployment to minimize blast radius if patch systems are compromised, robust vulnerability management, and comprehensive recovery planning including offline backups and system documentation. Organizations should treat potential compromise of centralized infrastructure—patch managers, backup servers, network devices—as a distribution vector and isolate affected systems immediately upon detection.

## Mentioned in this report

- Threat actors: Russia-nexus activity (unattributed)
- Malware: CaddyWiper, HermeticWiper, HermeticWizard, IsaacWiper, QuasarRAT, Saint Bot, WhisperGate
- Campaigns: Ukraine destructive malware campaign 2022

## Detection guidance (public sample)

### Shadow Copy or Backup Catalog Deletion

ATT&CK: T1490

Detects deletion of volume shadow copies or backup catalogs via vssadmin, wmic or wbadmin, a common step before destructive wiper activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shadow Copy or Backup Catalog Deletion
description: Detects commands that delete volume shadow copies, resize shadow storage
  or delete backup catalogs and system state backups. Wiper operators remove recovery
  options so that victims cannot restore data.
tags:
- attack.impact
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains:
    - delete shadows
    - resize shadowstorage
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_wbadmin:
    Image|endswith: \wbadmin.exe
    CommandLine|contains:
    - delete catalog
    - delete systemstatebackup
    - delete backup
  condition: 1 of selection_*
falsepositives:
- Backup or storage administrators intentionally pruning shadow copies
- Disk cleanup scripts run by IT during maintenance
level: high
id: bcca6efa-74ae-5da7-89c4-e4566c2163d1
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-057a
```

### Script Interpreter Direct Write to Physical Disk

ATT&CK: T1561.001

Detects PowerShell or cmd command lines that reference a PhysicalDrive device together with write operations, indicating MBR overwrite or disk wipe attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Script Interpreter Direct Write to Physical Disk
description: Detects PowerShell or cmd command lines that address a raw PhysicalDrive
  device together with write or copy primitives. This pattern indicates master boot
  record overwrite or disk content wiping, as done by destructive wipers.
tags:
- attack.impact
- attack.t1561.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \cmd.exe
  selection_device:
    CommandLine|contains: PhysicalDrive
  selection_write:
    CommandLine|contains:
    - WriteAllBytes
    - FileStream
    - Set-Content
    - Out-File
    - 'copy '
    - 'dd '
    - '> '
  condition: all of selection_*
falsepositives:
- Disk imaging or forensic scripts run by administrators against physical drives
- Hardware diagnostic tooling that wraps cmd or PowerShell
level: high
id: c5a4b64d-cb0a-5e13-90ef-a24da0f04c77
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-057a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

3 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-057a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1ded53da-438c-52e0-9d60-1f5764b0ebb2/destructive-malware-wiper-campaign-targets-ukraine-organizations.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup