Nikowiper

NikoWiper is a malicious software (malware) identified as a new data wiper attributed to Sandworm, a state-backed hacker group linked with Russia's Main Directorate of the General Staff of the Armed Forces (GRU). This malware, unique in its design compared to other strains, was used in an attack on the Ukrainian energy sector company in October 2022. Based on the SDelete Microsoft command line utility for securely deleting files, NikoWiper infiltrates systems often without user knowledge, potentially stealing personal information, disrupting operations, or holding data hostage. In April, the same group was suspected of trying to disrupt the Ukrainian power grid using another malware program called Industroyer2. By October, ESET had discovered new variants of both CaddyWiper and HermeticWiper, along with NikoWiper. The prime targets of these Russia-aligned groups remained Ukraine, where new versions of the known wipers RoarBat and NikoWiper were found, along with a newly identified wiper named SharpNikoWiper. Attributing these cyberattacks to Russian cyberoffensive groups may seem obvious due to the pattern of attacks and the victims involved, however, evidence-based attribution remains complex. While the presence of malwares like CaddyWiper, NikoWiper, RansomBoggs, or Prestige ransomware point towards a certain direction, definitive attribution requires rigorous investigation and concrete proof. Therefore, while there are strong suspicions, it is important to approach such attributions with caution.