Doublezero

Malware updated 23 days ago (2024-11-29T13:38:33.969Z)
Download STIX
Preview STIX
DoubleZero is a form of malware, specifically classified as a "wiper," that was discovered by CERT-UA on March 17th, 2022. Like other malicious software, it can infiltrate systems through suspicious downloads, emails, or websites, often without the user's knowledge. Unlike most malware, however, DoubleZero does not steal personal information or hold data hostage for ransom. Instead, it erases the first 4096 bytes of targeted files, effectively rendering them useless. This wiper was found to be hidden in archives distributed via targeted phishing attacks, demonstrating its primary propagation method. In the first quarter of 2022, DoubleZero became widespread along with several other data wipers, including WhisperGate, HermeticWiper, IsaacWiper, and CaddyWiper. These malware strains were used extensively in attacks against Ukrainian networks. Interestingly, some of these wipers, particularly WhisperGate, impersonated ransomware attacks. Victims received ransom notes, but no decryption keys were provided, resulting in irrecoverable data corruption. This deceptive approach added another layer of damage to the already destructive capabilities of these wipers. The list of wiper malware targeting Ukraine included DoubleZero alongside others like HermeticWiper, IsaacWiper, WhisperKill, WhisperGate, CaddyWiper, and AcidRain. Each of these wipers had unique characteristics and propagation methods. For instance, HermeticWiper spread using a network worm, while DoubleZero relied on phishing attacks. Notably, WhisperGate, similar to DoubleZero, appeared to be ransomware but lacked any data recovery mechanism. This wave of wiper malware attacks underscored the evolving nature of cybersecurity threats and the need for robust defense mechanisms.
Description last updated: 2024-01-06T05:48:18.138Z
What's your take? (Question 1 of 4)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Wiper
Malware
Ransomware
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
Alias DescriptionAssociation TypeVotes
The WhisperGate Malware is associated with Doublezero. WhisperGate is a malicious software (malware) deployed by Unit 29155 cyber actors, known for their extensive use of this malware, particularly against Ukraine. The malware corrupts a system's master boot record, displays a fake ransomware note, and encrypts files based on specific file extensions. TUnspecified
2
The Isaacwiper Malware is associated with Doublezero. IsaacWiper is a malicious software (malware) that has been identified as part of a series of cyberattacks against Ukraine in 2022. The malware is known to exploit and damage computer systems, often infiltrating them through suspicious downloads, emails, or websites. Once inside, IsaacWiper can disruUnspecified
2
Source Document References
Information about the Doublezero Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more