Loading malware…
ZeroWipe is a destructive Windows wiper associated with Sandworm activity targeting Ukrainian organizations during Russia’s war against Ukraine. It has been identified as one of multiple wipers used in coordinated disruptive operations intended to damage system integrity and availability by overwriting files or disks with zeroes or arbitrary data and then deleting data. ZeroWipe was publicly linked to the January 2023 attack on Ukraine’s national news agency Ukrinform, where attackers attempted centralized deployment through Active Directory Group Policy objects that created scheduled tasks. In that incident, ZeroWipe was used alongside other destructive tools including CaddyWiper, AwfulShred, BidSwipe, and the legitimate deletion utility SDelete, reflecting a multi-platform sabotage approach spanning Windows, Linux, and FreeBSD environments. Reporting also places ZeroWipe among the wipers used by Sandworm in 2022 operations aimed at Ukraine. The malware’s role is destructive rather than espionage-focused, and its observed use aligns with Sandworm’s broader pattern of targeting Ukrainian government, media, energy, and other critical or strategically relevant sectors with disruptive malware.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In 2022, the Russian APT used multiple wipers in attacks aimed at Ukraine, including AwfulShred, CaddyWiper, HermeticWiper, Industroyer2, IsaacWiper, WhisperGate, Prestige, RansomBoggs, and ZeroWipe.
"...CaddyWiper (Windows) ZeroWipe (Windows)..."; "...невдалу спробу... з використанням... ZeroWipe..."
4 distinct techniques documented for this family, organized by ATT&CK tactic.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned in a list of wipers observed after AcidRain.
Destructive wiper used in attacks (noted in 2022 activity).
Wiper malware referenced as used in 2022 attacks aimed at Ukraine.
Wiper malware referenced as used in 2022 attacks targeting Ukraine.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.