Loading malware…
BidSwipe is a destructive wiper targeting FreeBSD systems. It has been associated with Sandworm, also tracked as UAC-0082 and linked to Russia’s GRU, and was identified during the January 2023 attack against Ukraine’s national news agency Ukrinform. In that intrusion, BidSwipe was one of several cross-platform destructive components used alongside Windows and Linux wipers, reflecting an effort to impact heterogeneous enterprise and server environments.
Its purpose is to disrupt system integrity and availability by overwriting files or disks with zeroes or arbitrary data and then deleting them. BidSwipe has been described as a FreeBSD OS wiper and was deployed as a shell script, indicating a straightforward destructive role rather than covert persistence or espionage functionality. In the Ukrinform incident, attackers attempted centralized deployment through Active Directory Group Policy objects that created scheduled tasks, a tradecraft pattern repeatedly associated with Sandworm’s destructive operations.
BidSwipe fits Sandworm’s broader pattern of iterative, multi-family wiper use in operations aligned with Russian geopolitical objectives, particularly against Ukrainian organizations and critical or high-value institutions. High-confidence reporting supports its role as a FreeBSD-focused destructive malware component used in a coordinated campaign intended to impair operations and damage data availability.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned in a list of wipers observed after AcidRain.
FreeBSD-targeting wiper used in the Jan 2023 multi-wiper attack against a Ukrainian news agency (per CERT-UA).
Destructive malware family referenced as part of Sandworm-attributed destructive operations.
FreeBSD destructive script/tool used to wipe data to disrupt integrity and availability (overwriting and deleting).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.