Loading malware…
RURansom is a .NET-based destructive malware family that masquerades as ransomware while functioning operationally as a wiper. It was developed in the context of the Russia-Ukraine conflict and is designed to execute only against systems geolocated in Russia. The malware checks the victim’s public IP address and geolocation early in execution and terminates on non-Russian systems, reflecting a politically motivated targeting model rather than financially motivated cybercrime.
Once launched, RURansom checks for administrative privileges and attempts to relaunch itself with elevation when necessary. It enumerates local, removable, and network-accessible drives, limits activity on the system drive to user-accessible areas, and recursively processes files in targeted directories. It deletes backup files with specific backup-related extensions to hinder recovery, encrypts victim files with per-file randomly generated AES keys, writes the transformed data back to disk, and renames affected files with a new extension. Multiple analyses assess that recovery is effectively impossible because the keys are not retained, making the malware destructive in practice despite its ransomware presentation.
RURansom also exhibits worm-like propagation behavior. It copies itself to removable media and network drives under a lure-style executable name themed around the Russia-Ukraine war, enabling spread through connected systems and USB devices. In affected directories it drops a Russian-language ransom note stating that no payment is sought and that decryption is not possible, reinforcing the assessment that the malware is intended to damage Russian victims rather than extort them.
The malware has been compared with dnWipe due to code and tradecraft similarities, and some researchers have suggested a likely common developer or operator, although attribution remains unconfirmed. RURansom is widely categorized alongside other conflict-linked destructive malware families such as WhisperGate, IsaacWiper, HermeticWiper, and CaddyWiper. It primarily targets Windows environments and combines anti-recovery actions, destructive file processing, privilege escalation attempts, and simple self-propagation to maximize operational disruption.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK TIDs TID Tactic Description T1083 Discovery File and Directory Discovery
MITRE ATT&CK® Techniques Tactic Technique ID Execution T1204 User Execution Discovery T1518 Security Software Discovery T1087 Account Discovery
The RURansom wiper uses very similar code, which is unlikely to be copied from dnWipe by another actor due to its minimal spreading.
MITRE ATT&CK® Techniques Tactic Technique ID Execution T1204 User Execution Discovery T1518 Security Software Discovery
Upon execution, the malware immediately calls a function named IsRussia(), checks the system’s public IP address using a known IP address service... Later, it uses the IP address to determine the geographical location of machine... If the victim machine’s geolocation does not contain the word “Russia”, then the sample shows message box... and terminates execution.
In this blog, malware which has the intention to wipe a device is considered a wiper, be it as a part of malware or as the malware’s sole purpose.
MITRE ATT&CK TIDs TID Tactic Description T1486 Impact Data Encrypted for Impact
46 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A destructive wiper with code overlap to dnWipe that generates a random encryption key per file, functioning as a fake-ransomware-style wiper.
Named only as an example of notable 2022 wipers.
A destructive ransomware/wiper targeting systems geolocated in Russia. It checks whether the victim is in Russia, attempts privilege escalation, spreads to removable and network drives, deletes .bak backup files, encrypts files with AES using unique keys, renames them with the .fs_invade extension, and drops a politically themed ransom note stating there is no way to decrypt files and no payment option.
A .NET-based wiper targeting entities in Russia that irreversibly encrypts files using unique per-file keys that are not stored, making recovery impossible and classifying it as a wiper rather than ransomware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.