Loading malware…
ORCSHRED is a destructive malware family associated with Sandworm, the Russia-linked threat group widely tied to GRU operations. It was deployed during the April 2022 attack against a Ukrainian energy provider in conjunction with Industroyer2 and other wiping tools, including CaddyWiper, SOLOSHRED, and AWFULSHRED. ORCSHRED is one of the non-Windows destructive components used to target Unix-like systems in that operation, specifically Linux and Solaris environments, with the apparent objective of impairing recovery and disrupting supporting infrastructure alongside attempted electric-grid sabotage.
The malware is characterized in reporting as a disk-wiping or destructive tool rather than an espionage implant. Its role in the broader intrusion was to damage systems and hinder restoration efforts after or during operational disruption. ORCSHRED formed part of a coordinated multi-platform destructive toolkit spanning Windows, Linux, and Solaris hosts inside the victim environment. This use aligns with Sandworm’s longstanding pattern of pairing operational or disruptive attacks against critical infrastructure with wipers intended to maximize impact and complicate incident response.
ORCSHRED has been observed in attacks against the Ukrainian energy sector and is most strongly associated with critical infrastructure targeting in Ukraine. Available high-confidence reporting does not establish a distinct initial infection vector specific to ORCSHRED itself; in the known incident it was deployed after the attackers had already obtained substantial access within the victim network.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In addition to Industroyer2, Sandworm used several destructive malware families including CaddyWiper, ORCSHRED, SOLOSHRED and AWFULSHRED.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Disk-wiping malware for Linux environments used to destroy data and hinder recovery.
Destructive malware family used by Sandworm alongside Industroyer2.
Non-Windows platform wiper discovered in the Industroyer2-related Sandworm incident.
Destructive wiper malware family referenced as part of Sandworm-attributed destructive operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.