Loading malware…
HermeticWiper is a destructive Windows wiper first observed on 23 February 2022 in attacks against organizations in Ukraine immediately preceding Russia’s full-scale invasion. It is designed to render systems inoperable by corrupting boot records, partition information, and filesystem structures, and by overwriting files in selected system locations. The malware became notable for its use against hundreds of systems in Ukrainian government, financial, defense, aviation, IT services, and other organizations, and for its role in a broader pattern of disruptive cyber operations accompanying the war.
The malware abuses a legitimate EaseUS Partition Master driver to obtain low-level disk access. It carries multiple embedded driver variants for different Windows versions and architectures, drops and loads the appropriate signed driver, and then uses that driver to enumerate physical disks and perform destructive writes. Reported behavior includes overwriting the first sectors of physical drives, damaging the master boot record, corrupting partition metadata, and targeting NTFS artifacts such as the Master File Table and related filesystem structures. It also overwrites files in selected directories associated with system recovery, domain infrastructure, and event logging, then forces a shutdown or reboot so the disk corruption takes effect.
HermeticWiper also includes anti-recovery and anti-forensic measures. It disables crash dump generation, stops or disables Volume Shadow Copy functionality, adjusts token privileges needed for driver loading and shutdown, and modifies certain Explorer settings. Analyses consistently found no built-in network command-and-control or self-propagation capability in the wiper itself; deployment appears to have occurred after attackers had already obtained privileged access in victim environments. Multiple reports indicate distribution through Active Directory Group Policy in at least some intrusions, implying prior compromise of domain infrastructure. Additional reporting also cites spearphishing and compromise of exposed services as observed initial access vectors in the broader campaign.
HermeticWiper was deployed alongside other disruptive activity including DDoS attacks, website defacements, and a ransomware decoy known as HermeticRansom or PartyTicket. It has also been associated with the HermeticWizard worm component in some intrusions. The malware is widely linked in public reporting to Russian-aligned operations targeting Ukraine, and CERT-UA tracking has associated HermeticWiper activity with intrusion cluster UAC-0082. The campaign is regarded as a prominent example of wartime cyber sabotage focused on disruption rather than financial extortion.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Symantec in their analysis reported two different exploits used in the attacks carried out against the investigated targets: one targeting Microsoft SQL Server (CVE-2021-1636) and another affecting Apache Tomcat. | researchers at ESET have identified a series of components that, together, worked to cripple Ukrainian target networks: HermeticWiper, HermeticWizard, and HermeticRansom. HermeticWiper is the destructive payload
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...cyber offensives targeting Ukraine that resulted in the deployment of a data wiper called HermeticWiper on hundreds of machines in the East European nation.
HermeticWiper is a sophisticated malware family that is designed to destroy data and render a system inoperable.
CaddyWiper is notable for the fact that it doesn't share any similarities with previously discovered wipers in Ukraine, including HermeticWiper (aka FoxBlade or KillDisk) and IsaacWiper (aka Lasainraw).
ESET reported on March 1st that multiple Ukrainian organizations were targeted by an attack campaign comprising: HermeticWiper, a data-wiping malware.
ESET reported on March 1st that multiple Ukrainian organizations were targeted by an attack campaign comprising: HermeticWiper, a data-wiping malware.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
The HermeticWiper has been executed via a scheduled task on the victimized devices, as reported by Symantec.
The HermeticWiper has been executed via a scheduled task on the victimized devices, as reported by Symantec.
Before starting the EaseUS driver, HermeticWiper modifies several registry keys. One modification disables crash dumps by setting HKLM\SYSTEM\ControlSet001\Control\CrashControl\CrashDumpEnabled to 0.
following the establishment of persistence and privilege escalation via web shells or the use of schtasks
The HermeticWiper has been executed via a scheduled task on the victimized devices, as reported by Symantec.
Hermetic Wiper will then elevate its privileges to SeLoadDriverPrivilege and load the driver and start it as a service.
HermeticWiper calls OpenProcessToken()... Otherwise HermeticWiper will attempt to grant itself the privileges SeShutdownPrivilege and SeBackupPrivilege
According to ESET, the infection mechanism is similar to the HermeticWiper malware in that it operates via Default Domain Policy.
Create a service for the dropped epmntdrv.sys to finally load the driver.
Hermetic Wiper will then elevate its privileges to SeLoadDriverPrivilege and load the driver and start it as a service.
Up next is the check for both the above-mentioned privilege, as well as “SeBackupPrivilege”. The two privileges are then requested using AdjustTokenPrivileges... Next, the wiper attempts to acquires the “SeLoadDriverPrivilege” privilege. If this permission is not granted, the malware terminates itself.
One modification disables crash dumps by setting HKLM\SYSTEM\ControlSet001\Control\CrashControl\CrashDumpEnabled to 0. This change is likely to reduce forensic artifacts if the malware causes the system to stop unexpectedly.
Unlike HermeticWiper and ransomware like LockBit, DoubleZero doesn’t delete the shadow copies that can possibly be used to recover files from the damage.
HermeticWiper calls OpenProcessToken()... Otherwise HermeticWiper will attempt to grant itself the privileges SeShutdownPrivilege and SeBackupPrivilege
The driver is embedded (compressed using the MSLZ format) into the wiper’s resources... The compressed driver is then loaded from the resources, and written to “C:\WINDOWS\system32\drivers\[XX]dr”... The compressed file is then read from the disk, decompressed, and written to disk using the same file name, with “.sys” added to it.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
Another example is the case of HermeticWiper. As part of its activity, the malware drops one of several drivers to support its wiper actions.
The malware disables the volume shadow copy service to hinder recovery attempts. This tactic is commonly used by ransomware developers.
The destruction of the file system, rather than files within the file system, makes it harder to simply restore some files to “repair” the victimized machine.
the wiper runs a version of the EaseUS Partition Master software, a disk partitioning utility, which it uses to corrupt local data and then reboot the computer | it also damages the master boot record (MBR) section of a hard drive, which prevents the computer from booting into the operating system after the forced reboot
35 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
114 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A 2022 variant mentioned in the family history/updates that is referred to as HermeticWiper and uses legitimate EaseUS Partition Master software to damage disk partitions.
Wiper malware used to destroy or disrupt systems across multiple Ukrainian sectors immediately prior to the 2022 invasion.
Referenced as historical comparison for destructive malware focused on immediate operational impact.
Destructive wiper malware observed in telemetry shortly before the tournament kickoff window.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.