Loading story…
WhisperGate targeted Ukrainian government, non-profit, and IT organizations with destructive malware disguised as ransomware. Microsoft first observed the operation on January 13, 2022, and identified dozens of affected systems, warning that the visible impact likely understated its scope. The two-stage toolchain overwrote the Master Boot Record with a fraudulent ransom note, then downloaded a file-corrupting payload through Discord infrastructure. The malware offered no recovery mechanism: its purpose was to render devices inoperable, not collect ransom payments. Microsoft initially tracked the operation as DEV-0586, later renamed Cadet Blizzard, and added WhisperGate detections to Defender products.
Subsequent reporting associated WhisperGate with the suspected Russian state-sponsored Ember Bear/Nodaria threat ecosystem and catalogued an arsenal including Graphiron, GrimPlant, GraphSteel, OutSteel, SaintBot, BabaDeda, and Cobalt Strike Beacon. These reports described espionage campaigns primarily targeting Ukraine and Georgia, using spear-phishing and multistage malware to steal documents, credentials, screenshots, and SSH-related data; Symantec separately reported Graphiron information-stealing activity against Ukraine. Recommended defenses against WhisperGate include investigating published indicators and unusual remote authentication, blocking known malicious hashes, assessing restrictions on Discord infrastructure, enabling MFA, maintaining endpoint protection, patching exposed services, and keeping offline backups to support recovery from destructive attacks.
TTPs, infrastructure, and targeting history in one profile.
16 events from the most recent confirmed update back to the earliest known activity.
Contagio published a catalog covering Graphiron, GrimPlant, GraphSteel, OutSteel, BabaDeda, SaintBot, Cobalt Strike Beacon and WhisperGate. The article listed a collection of 218 samples totaling 209 MB, with MD5, SHA-1 and SHA-256 hash tables.
CERT-UA again reported phishing attacks targeting Ukrainian government organizations with GraphSteel and GrimPlant.
CERT-UA reported further phishing attacks against Ukrainian government organizations using GraphSteel and GrimPlant.
Mandiant identified a likely UNC2589 phishing campaign that used a malicious spreadsheet macro to deliver GrimPlant and GraphSteel.
CERT-UA reported phishing attacks against Ukrainian government organizations involving the GraphSteel information stealer and GrimPlant backdoor.
Mandiant identified a likely UNC2589 phishing campaign using evacuation themes. The campaign installed Remote Utilities and established persistence through a startup service.
A malicious Word attachment induced JavaScript and PowerShell execution to download a loader. The infection chain deployed OutSteel, SaintBot, a Windows Defender-disabling batch script and a legitimate Google Chrome installer.
ReliaQuest recorded identification and an advisory update on January 16, classifying WhisperGate as a high-severity destructive malware threat. The advisory documented its boot-record wiping and file-corruption stages and provided defensive guidance.
Microsoft first observed the destructive operation on January 13; other reporting described destructive attacks on January 14 and campaign activity on January 15. The malware affected Ukrainian government, nonprofit and technology organizations, overwriting boot records and corrupting files while masquerading as ransomware.
A campaign used political-themed Word documents against Georgian government officials. Document macros created a C# dropper that delivered an AutoIt document-stealing Trojan.
Researchers identified phishing against Ukrainian government entities that they subsequently linked to a similar July 2021 campaign targeting Georgian officials.
Ember Bear, also tracked as Nodaria, UNC2589 and UAC-0056, was described as active since at least March 2021. The suspected Russian state-sponsored group primarily targeted Ukraine and Georgia.
An April 2023 update identified Cadet Blizzard as the new name for DEV-0586 under Microsoft's weather-themed threat actor taxonomy.
Mandiant attributed the January 14, 2022 destructive Ukrainian attack using PAYWIPE, also called WhisperGate, to UNC2589. The source does not specify when Mandiant made this attribution.
ReliaQuest added indicators associated with WhisperGate to its Emergency Feed to support detection and blocking.
Microsoft reported dozens of impacted systems and initially tracked the activity as DEV-0586. Its report detailed the fake ransom note, Discord-hosted file-corrupting payload and indicators of compromise, and stated that Microsoft Defender protections had been implemented.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 285 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
contagiodump.blogspot.com
Open sourcereliaquest.com
Open sourcemicrosoft.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian government entities were hit by a coordinated wave of cyber activity that combined website defacements, destructive malware, and phishing operations using compromised or spoofed official email accounts. Cisco Talos said the **WhisperGate** intrusion chain masqueraded as ransomware but instead overwrote the master boot record and deployed a final-stage wiper, **WhisperKill**, to destroy files across infected systems while attempting to disable Microsoft Defender. Investigators assessed the attackers likely had access for months using stolen credentials, and Ukrainian officials said the incidents followed a broader pattern of hybrid aggression that had already wiped some government systems and defaced dozens of agency websites. At the same time, Ukrainian defenders warned of fresh phishing campaigns targeting government institutions with emails impersonating trusted state bodies, including the National Health Service of Ukraine and compromised judiciary accounts. Those messages delivered malware-laced documents hosted on Discord and installed the **OutSteel** stealer and **SaintBot**. Talos and Ukrainian authorities said the destructive attacks were intertwined with disinformation activity and possible false-flag efforts designed to shift blame, while formal attribution remained unconfirmed; Ukrainian officials said signs pointed to a Russian APT actor and noted investigative support from partners including the United States and United Kingdom.
Aug 15, 2026
Multiple destructive malware campaigns struck Ukraine around the start of Russia’s invasion, with **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, **WhisperGate**, and **DoubleZero** used against government, financial, and other organizations. Researchers reported that HermeticWiper corrupted boot records and partition data by abusing a legitimate EaseUS driver, while CaddyWiper and DoubleZero erased user data, partition information, and critical registry or boot components, often while deliberately sparing domain controllers to preserve attacker access. Several incidents appeared to follow prior compromise of victim networks, including abuse of **Active Directory**, scheduled execution, and in some cases worm-like spread via **HermeticWizard**; HermeticRansom was also deployed as a likely decoy alongside destructive activity. The destructive operations extended beyond enterprise Windows environments. **AcidRain** was used in the attack on Viasat’s **KA-SAT** network, wiping satellite modems in Ukraine and elsewhere in Europe by recursively destroying filesystems and storage devices, while the **Industroyer2** operation targeted a Ukrainian energy provider with malware built to communicate over **IEC-104** and cut power, paired with Windows, Linux, and Solaris wipers including **CaddyWiper**, **ORCSHRED**, **SOLOSHRED**, and **AWFULSHRED**. Across the reporting, defenders were urged to watch for mass file overwrites, shadow copy and event log deletion, MBR or partition changes, suspicious use of administrative tooling and group policy, and to maintain tested, isolated backups to recover from destructive attacks.
Aug 15, 2026
Ukraine said Russia-linked threat groups intensified cyberattacks against its critical infrastructure, government, communications, energy, and humanitarian logistics networks, using phishing and multiple destructive malware families including **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, and **DoubleZero**. CERT-UA attributed activity during the period to several tracked clusters such as `UAC-0056`, `UAC-0051/UNC1151`, `UAC-0028/APT28`, and `UAC-0033/XDSpy`, and said the operations were tied to actors affiliated with Russian and Belarusian state structures and proxy entities. Ukrainian officials also reported targeting of organizations documenting war crimes and of European charities supporting refugees, underscoring that the campaign extended beyond domestic wartime targets. Researchers separately documented destructive intrusions in which **HermeticWiper** and **CaddyWiper** were deployed through Windows Group Policy after attackers had already gained broad control of victim networks. HermeticWiper hit finance organizations, government contractors, and other Ukrainian systems while also affecting some machines in Latvia and Lithuania; it corrupted local data and the master boot record, leaving devices unable to boot. In parallel, CERT-UA warned that phishing emails posing as antivirus updates delivered **Cobalt Strike** along with the **GraphSteel** and **GrimPlant** backdoors, a campaign linked with medium confidence to `UAC-0056`, showing that espionage, access operations, and destructive attacks were being conducted in tandem.
Aug 15, 2026