HermeticWiper

MITRE ATT&CK: S0697 View on attack.mitre.org

Aliases: Trojan.Killdisk, DriveSlayer, FoxBlade, KillDisk.NCV, NEARMISS, HermeticWiper

First seen
2022-02-23 00:00:00
Malware type
wiper
Family
Malware family
Operating systems
windows
Related IoCs
14 (14 malicious)
Last IoC activity
2026-10-17 15:55:10
Profile updated
2026-07-07 12:44:09

Targeted industries: government-and-public-sector financial-services defense-and-aerospace transportation-and-logistics technology-and-telecommunications

Targeted regions: country_code:ua country_code:lv country_code:lt

Context

HermeticWiper is a data wiper that has been used since at least early 2022, primarily against Ukraine with additional activity observed in Latvia and Lithuania. Some sectors targeted include government, financial, defense, aviation, and IT services.

Recent IoC activity

14 malicious indicators in Maltiverse are attributed to HermeticWiper (S0697). The 14 most recently updated:

TypeIndicatorUpdatedSources
URL https://bazaar.abuse.ch/browse/signature/HermeticWiper/ 2026-10-18 1
file sample a64c3e0522fad787b95bfb6a30c3aed1b5786e69e88e023c062ec7e5cebf4d3e_1.exe 2026-10-17 3
file sample 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.zip 2026-10-17 1
hostname bazaar.abuse.ch 2026-10-14 6
file sample 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591 2026-10-03 3
file sample HermeticWiper.exe 2026-09-06 2
file sample 0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.zip 2026-08-27 1
file sample 0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.zip 2026-08-07 1
file sample pilotredsun - Riverdance.m4a 2026-08-07 1
file sample 2026-07-25_f781f182ea3fda4aded7ff06f3b550e6_conti_elex_hermetic-wiper_hermeticwiper 2026-07-25 1
file sample 06086c1da4590dcc7f1e10a6be3431e1166286a9e7761f2de9de79d7fda9c397 2026-04-26 2
file sample The Bakageddon.exe 2026-04-07 1
file sample 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.zip 2026-03-24 1
file sample 3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767 2025-02-13 1

Detection coverage

  • 4 YARA rules
  • 579 Sigma rules

Malware & tools used

  • Scheduled Task (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • Access Token Manipulation (attack-pattern)
  • Group Policy Modification (attack-pattern)
  • Data Destruction (attack-pattern)
  • Code Signing (attack-pattern)
  • Modify Registry (attack-pattern)
  • Indicator Removal (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Disk Structure Wipe (attack-pattern)
  • Inhibit System Recovery (attack-pattern)
  • Time Based Checks (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Native API (attack-pattern)
  • Compression (attack-pattern)
  • Local Storage Discovery (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Clear Windows Event Logs (attack-pattern)
  • Windows Service (attack-pattern)
  • File Deletion (attack-pattern)
  • Service Stop (attack-pattern)
  • Disk Content Wipe (attack-pattern)
  • Service Execution (attack-pattern)

Detection rules

  • MALPEDIA_Win_Hermeticwiper_Auto (yara-rule)
  • CLUSTER25_UNC1222_Hermeticwiper_23433_10001 (yara-rule)
  • TRELLIX_ARC_Hermeticwiper (yara-rule)
  • SEKOIA_Wiper_Hermeticwiper_Variants (yara-rule)

Reports & references

  • services.google.com — Google Fog Of War Research Report (report)
  • services.google.com — Apt44 Unearthing Sandworm (report)
  • Microsoft — Analysis Resources Cyber Threat Activity Ukraine (report)
  • Mandiant — Russia Invasion Ukraine Retaliation (report)
  • trellix.com — Growling Bears Make Thunderous Noise (report)
  • Trend Micro — Ioc%20Resource%20For%20Russia Ukraine%20Conflict Related%20Cyberattacks 03032022 (report)
  • eclypsium.com — Conti Targets Critical Firmware (report)
  • cybersecurity.att.com — Analysis On Recent Wiper Attacks Examples And How They Wiper Malware Works (report)
  • trustwave.com — Overview Of The Cyber Weapons Used In The Ukraine Russia War (report)
  • fortinet.com — The Increasing Wiper Malware Threat (report)
  • youtube.com — Watch (report)
  • inquest.net — Ukraine Cyberwar Overview (report)
  • socradar.io — What You Need To Know About Russian Cyber Escalation In Ukraine (report)
  • blog.nviso.eu — Threat Update Ukraine Russia Tensions (report)
  • marcoramilli.com — Diskkill Hermeticwiper And Notpetya Dissimilarities (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Hermeticwiper (report)
  • blog.malwarebytes.com — Hermeticwiper A Detailed Analysis Of The Destructive Malware That Targeted Ukraine (report)
  • zdnet.com — Microsoft Finds Foxblade Malware On Ukrainian Systems Removing Rt From Windows App Store (report)
  • secureworks.com — Disruptive Hermeticwiper Attacks Targeting Ukrainian Organizations (report)
  • cloudsek.com — Technical Analysis Of The Hermetic Wiper Malware Used To Target Ukraine (report)
  • yoroi.company — Diskkill Hermeticwiper A Disruptive Cyber Weapon Targeting Ukraines Critical Infrastructures (report)
  • Palo Alto Unit 42 — Preparing For Cyber Impact Russia Ukraine Crisis (report)
  • community.riskiq.com — 9F59Cb85 (report)
  • elastic.github.io — Article (report)
  • Mandiant — Information Operations Surrounding Ukraine (report)

External references