MalwareUsed by 2 actors

Nemo Wiper

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Ukrainian Cyber Alliance

In an operation with the Ukrainian Cyber Alliance, Hacking Cat deployed Nemo Wiper.

via the hacker newsthehackernews.com

Hacking Cat

In an operation with the Ukrainian Cyber Alliance, Hacking Cat deployed Nemo Wiper.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

4 techniques

T1112Modify RegistryEvidence1

Служба меняет HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR\Start на 4, блокируя загрузку USB Mass Storage; скрипт также включает AutoAdminLogon и Safe Mode with Networking.

T1136Create AccountEvidence1

LSAPlatformUpdate.ps1 создает нового локального пользователя и добавляет его в группу администраторов, затем включает AutoAdminLogon.

T1543.003Windows ServiceEvidence1

DLL регистрирует службу Windows LSANetLogin, указывая C:\ProgramData\nplsvc.exe как исполняемый файл службы.

T1556.008Network Provider DLLEvidence1

LSAPlatformUpdate.ps1 регистрирует LSANetLogin64w7.dll или LSANetLogin32w7.dll в качестве сетевого провайдера, который запускается после перезагрузки.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence1

DLL регистрирует службу Windows LSANetLogin, указывая C:\ProgramData\nplsvc.exe как исполняемый файл службы.

Defense Impairment

3 techniques

T1112Modify RegistryEvidence1

T1556.008Network Provider DLLEvidence1

T1685.005Clear Windows Event LogsEvidence1

Версия Monkey на C++ очищает журналы System, Security и Application, а PowerShell-цепочка отключает часть событий Windows PowerShell Event Log и очищает следы работы.

Credential Access

1 technique

T1556.008Network Provider DLLEvidence1

Discovery

1 technique

T1057Process DiscoveryEvidence1

Gorilla RAT поддерживает команду processes для получения списка процессов; nplsvc.exe перечисляет процессы для поиска explorer.exe.

Command and Control

1 technique

T1573Encrypted ChannelEvidence1

Адрес C2 Gorilla RAT зашифрован побайтовым преобразованием с четырехбайтовым ключом; DLL-компоненты расшифровывают полезные нагрузки ChaCha20 и XOR.

Impact

2 techniques

T1485Data DestructionEvidence4

Nemo Wiper “overwrites files with random bytes and fills the remaining free disk space with files containing random alphanumeric names and the .lock extension.”

T1489Service StopEvidence1

Перед уничтожением Nemo Wiper выполняет net stop для MSSQLSERVER, SQLSERVERAGENT, MySQL, PostgreSQL, MongoDB, Oracle, Docker, Hyper-V, vmms и Elasticsearch, а также wsl --shutdown.

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

the hacker newsNews

Sep 16, 2026

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Destructive malware that overwrites files with random bytes and fills free disk space with randomly named files using the .lock extension.

cysecurity newsNews

Sep 15, 2026

Pro-Ukraine Hacking Cat Group Deploys New Malware Against Russian Targets - CySecurity News - Latest Information Security and Hacking Incidents

Destructive wiper used in a June 2026 operation against a heating provider. It erases data and is intended to disrupt critical infrastructure rather than generate ransom payments.

the record mediaNews

Sep 14, 2026

Pro-Ukraine Hacking Cat group deploying new malware against Russian targets | The Record from Recorded Future News

Destructive wiper malware intended to destroy data and disrupt infrastructure rather than obtain ransom payments.

securelist ruNews

Sep 11, 2026

Разбираем инструментарий группировки Hacking Cat (Хакерский кiт) | Securelist

A destructive Windows wiper delivered through a malicious network-provider/DLL persistence chain found alongside Gorilla RAT in a victim environment. It stops services protecting database, virtualization, container, and WSL data; partially overwrites files with random data based on file size; and exhausts free disk space with random files to hinder recovery.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 2 actors

Nemo Wiper

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Ukrainian Cyber Alliance

In an operation with the Ukrainian Cyber Alliance, Hacking Cat deployed Nemo Wiper.

via the hacker newsthehackernews.com

Hacking Cat

In an operation with the Ukrainian Cyber Alliance, Hacking Cat deployed Nemo Wiper.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

4 techniques

T1112Modify RegistryEvidence1

T1136Create AccountEvidence1

T1543.003Windows ServiceEvidence1

DLL регистрирует службу Windows LSANetLogin, указывая C:\ProgramData\nplsvc.exe как исполняемый файл службы.

T1556.008Network Provider DLLEvidence1

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence1

DLL регистрирует службу Windows LSANetLogin, указывая C:\ProgramData\nplsvc.exe как исполняемый файл службы.

Defense Impairment

3 techniques

T1112Modify RegistryEvidence1

T1556.008Network Provider DLLEvidence1

T1685.005Clear Windows Event LogsEvidence1

Credential Access

1 technique

T1556.008Network Provider DLLEvidence1

Discovery

1 technique

T1057Process DiscoveryEvidence1

Command and Control

1 technique

T1573Encrypted ChannelEvidence1

Impact

2 techniques

T1485Data DestructionEvidence4

Nemo Wiper “overwrites files with random bytes and fills the remaining free disk space with files containing random alphanumeric names and the .lock extension.”

T1489Service StopEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

the hacker newsNews

Sep 16, 2026

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Destructive malware that overwrites files with random bytes and fills free disk space with randomly named files using the .lock extension.

cysecurity newsNews

Sep 15, 2026

Pro-Ukraine Hacking Cat Group Deploys New Malware Against Russian Targets - CySecurity News - Latest Information Security and Hacking Incidents

Destructive wiper used in a June 2026 operation against a heating provider. It erases data and is intended to disrupt critical infrastructure rather than generate ransom payments.

the record mediaNews

Sep 14, 2026

Pro-Ukraine Hacking Cat group deploying new malware against Russian targets | The Record from Recorded Future News

Destructive wiper malware intended to destroy data and disrupt infrastructure rather than obtain ransom payments.

securelist ruNews

Sep 11, 2026

Разбираем инструментарий группировки Hacking Cat (Хакерский кiт) | Securelist

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.