Doublezero

DoubleZero is a form of malware, specifically classified as a "wiper," that was discovered by CERT-UA on March 17th, 2022. Like other malicious software, it can infiltrate systems through suspicious downloads, emails, or websites, often without the user's knowledge. Unlike most malware, however, DoubleZero does not steal personal information or hold data hostage for ransom. Instead, it erases the first 4096 bytes of targeted files, effectively rendering them useless. This wiper was found to be hidden in archives distributed via targeted phishing attacks, demonstrating its primary propagation method. In the first quarter of 2022, DoubleZero became widespread along with several other data wipers, including WhisperGate, HermeticWiper, IsaacWiper, and CaddyWiper. These malware strains were used extensively in attacks against Ukrainian networks. Interestingly, some of these wipers, particularly WhisperGate, impersonated ransomware attacks. Victims received ransom notes, but no decryption keys were provided, resulting in irrecoverable data corruption. This deceptive approach added another layer of damage to the already destructive capabilities of these wipers. The list of wiper malware targeting Ukraine included DoubleZero alongside others like HermeticWiper, IsaacWiper, WhisperKill, WhisperGate, CaddyWiper, and AcidRain. Each of these wipers had unique characteristics and propagation methods. For instance, HermeticWiper spread using a network worm, while DoubleZero relied on phishing attacks. Notably, WhisperGate, similar to DoubleZero, appeared to be ransomware but lacked any data recovery mechanism. This wave of wiper malware attacks underscored the evolving nature of cybersecurity threats and the need for robust defense mechanisms.