Loading story…
Ukrainian government entities were hit by a coordinated wave of cyber activity that combined website defacements, destructive malware, and phishing operations using compromised or spoofed official email accounts. Cisco Talos said the WhisperGate intrusion chain masqueraded as ransomware but instead overwrote the master boot record and deployed a final-stage wiper, WhisperKill, to destroy files across infected systems while attempting to disable Microsoft Defender. Investigators assessed the attackers likely had access for months using stolen credentials, and Ukrainian officials said the incidents followed a broader pattern of hybrid aggression that had already wiped some government systems and defaced dozens of agency websites.
At the same time, Ukrainian defenders warned of fresh phishing campaigns targeting government institutions with emails impersonating trusted state bodies, including the National Health Service of Ukraine and compromised judiciary accounts. Those messages delivered malware-laced documents hosted on Discord and installed the OutSteel stealer and SaintBot. Talos and Ukrainian authorities said the destructive attacks were intertwined with disinformation activity and possible false-flag efforts designed to shift blame, while formal attribution remained unconfirmed; Ukrainian officials said signs pointed to a Russian APT actor and noted investigative support from partners including the United States and United Kingdom.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
On 2024-06-26, the U.S. Justice Department announced an indictment charging Russian national Amin Timovich Stigal with conspiring with GRU members to deploy WhisperGate against dozens of Ukrainian government entities in January 2022. The indictment also alleged related intrusions, data theft and sale, later targeting of transportation infrastructure in a Central European country, and probing of a U.S. federal agency using the same infrastructure.
On 2022-01-31, Ukrainian cybersecurity officials warned of a new phishing campaign targeting government institutions using compromised or spoofed government email addresses, including messages appearing to come from the National Health Service of Ukraine. The emails delivered Discord-hosted malware-laced documents that deployed the OutSteel stealer and SaintBot.
Two days before the later Monday warning, Ukrainian officials warned that compromised email accounts from the Ukrainian judiciary were being used in a phishing campaign. The messages, disguised as court inquiries, targeted mostly Ukrainian government entities with malware.
On 2022-01-21, Cisco Talos published analysis of the January 2022 attacks, naming the wiper malware WhisperGate and describing its multi-stage infection chain, including a Discord-hosted payload and the WhisperKill file wiper. Talos assessed the attackers likely used stolen credentials and may have maintained access for months before the attack.
On 2022-01-17, the Ukrainian government publicly accused Russia of orchestrating the recent defacements of government and public institution websites, saying the campaign aimed to intimidate society, disrupt the public sector, and undermine trust in government. Ukraine also said the attackers likely accessed the affected sites through the infrastructure of a private company that managed some of them, while Russia denied involvement.
On 2022-01-13, Microsoft first observed the destructive malware later known as WhisperGate targeting multiple organizations in Ukraine. The new reference says Microsoft publicly attributed the malware to the threat actor it tracks as DEV-0586.
In January 2022, dozens of Ukrainian government agency websites were defaced and some government systems were hit with destructive malware that wiped computers. Ukrainian officials later said the website compromise appeared to begin with a supply-chain attack on an infrastructure software development company.
On 2022-02-04, Cisco Talos updated its analysis to incorporate CERT-UA and SSSCIP advisories. The update added findings that the attacks were intertwined with a broader disinformation effort and may have included false-flag elements intended to blame pro-Ukrainian actors or Poland.
On 2022-01-26, CERT-UA published an advisory on WhisperGate that described possible initial access vectors. It said a supply-chain compromise was the likely entry point, while not ruling out exploitation of OctoberCMS and Log4j vulnerabilities, and noted suspicious use of legitimate accounts and Impacket tools.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourcecyberscoop.com
Open sourceblog.gigamon.com
Open sourcenetskope.com
Open sourceblog.talosintelligence.com
Open sourceunit42.paloaltonetworks.com
Open sourcethehackernews.com
Open sourceedition.cnn.com
Open sourcecert.gov.ua
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukraine said Russia-linked threat groups intensified cyberattacks against its critical infrastructure, government, communications, energy, and humanitarian logistics networks, using phishing and multiple destructive malware families including **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, and **DoubleZero**. CERT-UA attributed activity during the period to several tracked clusters such as `UAC-0056`, `UAC-0051/UNC1151`, `UAC-0028/APT28`, and `UAC-0033/XDSpy`, and said the operations were tied to actors affiliated with Russian and Belarusian state structures and proxy entities. Ukrainian officials also reported targeting of organizations documenting war crimes and of European charities supporting refugees, underscoring that the campaign extended beyond domestic wartime targets. Researchers separately documented destructive intrusions in which **HermeticWiper** and **CaddyWiper** were deployed through Windows Group Policy after attackers had already gained broad control of victim networks. HermeticWiper hit finance organizations, government contractors, and other Ukrainian systems while also affecting some machines in Latvia and Lithuania; it corrupted local data and the master boot record, leaving devices unable to boot. In parallel, CERT-UA warned that phishing emails posing as antivirus updates delivered **Cobalt Strike** along with the **GraphSteel** and **GrimPlant** backdoors, a campaign linked with medium confidence to `UAC-0056`, showing that espionage, access operations, and destructive attacks were being conducted in tandem.
Aug 15, 2026
Cyber operations tied to Russia’s invasion of Ukraine ranged from destructive malware and espionage to broader disruption against Ukrainian and allied targets. Researchers and government agencies documented **WhisperGate**, **HermeticWiper**, **CaddyWiper**, **DoubleZero**, and **FoxBlade** activity against Ukrainian networks, while Microsoft said it seized seven **Strontium** domains used to target Ukrainian institutions, media, and foreign-policy organizations in the U.S. and EU. Talos also reported a campaign against a Ukrainian software developer using a modified **GoMet** backdoor, raising supply-chain concerns, and Symantec described sustained **Shuckworm/Gamaredon** espionage using multiple **Pterodo** variants for persistence. Later reporting warned that Russian operations were expanding beyond Ukraine to logistics, transportation, defense, and energy organizations supporting Kyiv, including activity in Poland and across Europe’s defense supply chain.
Aug 15, 2026
Multiple destructive malware campaigns struck Ukraine around the start of Russia’s invasion, with **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, **WhisperGate**, and **DoubleZero** used against government, financial, and other organizations. Researchers reported that HermeticWiper corrupted boot records and partition data by abusing a legitimate EaseUS driver, while CaddyWiper and DoubleZero erased user data, partition information, and critical registry or boot components, often while deliberately sparing domain controllers to preserve attacker access. Several incidents appeared to follow prior compromise of victim networks, including abuse of **Active Directory**, scheduled execution, and in some cases worm-like spread via **HermeticWizard**; HermeticRansom was also deployed as a likely decoy alongside destructive activity. The destructive operations extended beyond enterprise Windows environments. **AcidRain** was used in the attack on Viasat’s **KA-SAT** network, wiping satellite modems in Ukraine and elsewhere in Europe by recursively destroying filesystems and storage devices, while the **Industroyer2** operation targeted a Ukrainian energy provider with malware built to communicate over **IEC-104** and cut power, paired with Windows, Linux, and Solaris wipers including **CaddyWiper**, **ORCSHRED**, **SOLOSHRED**, and **AWFULSHRED**. Across the reporting, defenders were urged to watch for mass file overwrites, shadow copy and event log deletion, MBR or partition changes, suspicious use of administrative tooling and group policy, and to maintain tested, isolated backups to recover from destructive attacks.
Aug 15, 2026