Malware

Double Zero

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

“The attackers used phishing campaigns to deliver [certain wiper] malware and tried to bring some disruption to Ukrainian IT systems,” Zhora said.

Persistence

1 technique

T1112Modify RegistryEvidence1

Annotations ID Technique Tactic T1112 Modify Registry Defense Evasion Exploitation Installation

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Annotations ID Technique Tactic T1112 Modify Registry Defense Evasion Exploitation Installation

Impact

1 technique

T1485Data DestructionEvidence1

Observed attackers are also targeting organizations that publish information about war crimes online and at least four types of malware have been deployed. According to the official, they’re called HermeticWiper, IsaacWiper, CaddyWiper and Double Zero.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

splunk researchNews

May 13, 2026

Detection: Suspicious Process File Path | Splunk Security Content

Associated Analytic Story ... Chaos Ransomware Double Zero Destructor Hermetic Wiper Warzone RAT ...

splunk researchNews

May 2, 2025

Detection: Windows Deleted Registry By A Non Critical Process File Path | Splunk Security Content

A destructive wiper malware referenced as deleting registry keys to evade defenses or enable destructive payload effects, potentially causing significant system damage, loss of critical configurations, and service disruption.

nextgovNews

Mar 24, 2022

Ukrainian Cyber Lead Says ‘At Least 4 Types of Malware’ in Use to Target Critical Infrastructure and Humanitarian Aid - Nextgov/FCW

A destructive wiper malware cited by the Ukrainian official as used in attacks intended to disrupt Ukrainian IT systems.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Double Zero

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

“The attackers used phishing campaigns to deliver [certain wiper] malware and tried to bring some disruption to Ukrainian IT systems,” Zhora said.

Persistence

1 technique

T1112Modify RegistryEvidence1

Annotations ID Technique Tactic T1112 Modify Registry Defense Evasion Exploitation Installation

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Annotations ID Technique Tactic T1112 Modify Registry Defense Evasion Exploitation Installation

Impact

1 technique

T1485Data DestructionEvidence1

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

splunk researchNews

May 13, 2026

Detection: Suspicious Process File Path | Splunk Security Content

Associated Analytic Story ... Chaos Ransomware Double Zero Destructor Hermetic Wiper Warzone RAT ...

splunk researchNews

May 2, 2025

Detection: Windows Deleted Registry By A Non Critical Process File Path | Splunk Security Content

nextgovNews

Mar 24, 2022

Ukrainian Cyber Lead Says ‘At Least 4 Types of Malware’ in Use to Target Critical Infrastructure and Humanitarian Aid - Nextgov/FCW

A destructive wiper malware cited by the Ukrainian official as used in attacks intended to disrupt Ukrainian IT systems.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.