HermeticWiper

HermeticWiper is a destructive malware that was first disclosed by cybersecurity researchers on February 23, 2022. This malicious software was deployed against organizations in Ukraine, with the intent of destroying computer systems and rendering them inoperable. The malware infiltrates systems through suspicious downloads, emails, or websites, often without user knowledge. Once inside, it can disrupt operations, steal personal information, or even hold data hostage for ransom. The deployment of HermeticWiper was part of a broader cyber attack campaign attributed to Russian Advanced Persistent Threat (APT) actors. In 2022, these threat actors utilized multiple types of wiper malware, including AwfulShred, CaddyWiper, Industroyer2, IsaacWiper, WhisperGate, Prestige, RansomBoggs, and ZeroWipe, all aimed at Ukraine. The attacks were so severe that they led to the disruption of Ukraine's border control systems. Notably, HermeticWiper was reported to have been developed and deployed by GRU, Russian military intelligence. A joint Cybersecurity Advisory (CSA) between the Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) has provided information on the WhisperGate and HermeticWiper malware, as well as open-source indicators of compromise (IOCs) for organizations to detect and prevent the malware. Despite using similar deployment techniques, the campaign involving HermeticWiper is distinct from other recent destructive attacks. It shares victimology with recent Russian state-aligned activity, specifically affecting certain geographies and countries, and overlaps with previous victims of the FoxBlade malware, also known as HermeticWiper.