Foxblade

Foxblade, also known as HermeticWiper, is a form of malware designed to exploit and damage computer systems. It was first reported in attacks that took place on March 10th, 2022, as part of the Hermetic campaign. The campaign also saw the deployment of another malware called HermeticRansom (or SonicVote) on March 17th, 2022, and a combined attack using both Foxblade and HermeticRansom on March 24th, 2022. This malicious software infiltrates systems through suspicious downloads, emails, or websites, often without the user's knowledge, and can disrupt operations, steal personal information, or hold data for ransom. The malware Foxblade, alongside another destructive malware named Caddywiper, was reportedly used by a state actor to target Ukraine, potentially causing significant disruption. As of late 2022, experts suggested that this state actor might have been testing additional malware with similar capabilities, targeting organizations outside Ukraine that serve key functions in Ukraine’s supply lines. These attacks have significantly impacted multiple critical infrastructure organizations within Ukraine. The group behind these attacks shares victimology with recent Russian state-aligned activity, specifically affecting certain geographies and countries. Sandworm, a unit linked to the Russian military intelligence agency GRU, has been identified as potentially preparing to follow its previous Foxblade and Caddywiper efforts with new wiper malware. Despite similarities in deployment techniques, the campaign is distinct from other recent destructive attacks leveraging malwares such as AprilAxe (ArguePatch)/CaddyWiper or Foxblade (HermeticWiper).