MALWARE/TOOLSPROFILE

By Insikt Group®
May 12, 2022

Overview of the9 Distinct Data Wipers Usedin the Ukraine War

MALWARE/TOOL PROFILEThis report serves as a high-level comparative overview of the 9 wipers
analyzed by Insikt Group in association with the ongoing Ukraine/Russia war. It
is meant to provide insight into the similarities and differences between the tools
and the geopolitical implications of their development and usage. The intended
audience of this report is those looking for a high-level technical overview of thewipers. Sources used include reverse engineering tools, OSINT, the Recorded
Future® Platform, and PolySwarm.

Executive Summary
While the Ukraine/Russia war is primarily a kinetic conflict,several destructive data wipers targeting Ukrainian entities
emerged in the immediate lead-up to and during the first 2-plusmonths of the war, bringing the conflict to cyberspace. The
9 wipers analyzed by Insikt Group had the same high-level
destructive goal but differed in technical implementation andthe operating systems they targeted, suggesting that each was a
distinct tool, possibly created by different authors. Over time, thewipers also became more simplistic at a technical level, including
reductions in the number of stages, the existence of obfuscation,
and attempts to masquerade as ransomware, though none wereat the level of sophistication of some other known Russian statesponsored malware.

Key Judgments• 6 of the wipers associated with the Ukraine/Russia
conflict analyzed by Insikt Group all serve the samehigh-level destructive purpose of rendering a Windows
machine inoperable; the other wipers targeted Linuxsystems (including satellite modems).
• The wipers do not share obvious code similarities
between them and are unlikely to be iterations on, or new
versions of, each other.
• HermeticWiper was the only wiper found to bedistributed by a worm component, known as
HermeticWizard. HermeticWizard restricted its spread to
local IP addresses within the victim’s network, preventing
the external distribution seen with other worm incidents
like NotPetya.
• None of the wipers themselves contained any network
connectivity functionality that would permit them to
exfiltrate victim data further, suggesting that theirpurpose was targeted destruction of specific entities.

The wiper deployment activity aligns with prior Russianstate-sponsored cyber operations against Ukraine as well asother nations; these efforts often occur before and during active
conflict and are likely intended to act as a “force multiplier” forRussian military operations. Ongoing efforts to deploy disruptive
cyber operations against Ukrainian targets show that the Russian
government almost certainly considers such operations to bevaluable, and suggest that these efforts will likely continue.

1

MTP-2022-0512

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOL PROFILE

Background

Threat Analysis

There is an observable, historical pattern of entities,
Insikt Group analyzed 9 of the wipers associated withvery likely acting in support of Russian government interests, the Ukraine/Russia conflict - WhisperGate, HermeticWiper,engaging in cyber operations prior to and concurrent with IsaacWiper, CaddyWiper, AcidRain, AwfulShred, SoloShred,
Russian military operations. Such operations date back to at DoubleZero, and DesertBlade. The analysis showed that 8 of theleast August 2008 when reports describe pro-Russian hacktivists 9 wipers differed significantly from each other in implementation,engaging in a series of sustained Distributed Denial of Service despite remaining fairly similar in their overall functionality and(DDoS) attacks and website defacements against a number of purpose, and do not appear to originate from the same author.
Georgian government, banking, media, communications, andTable 1 below contains a brief, high-level summary of eachtransportation resources at approximately the same time thewiper’s functionality. The MBR (master boot record), GPT (GUID
Russian military was launching an offensive in South Ossetia
partition table), and Files columns indicate which components ofand engaging in a bombing campaign throughout Georgia. Since
the victim’s machine were targeted by the wiper. For the purposes
2014, Russian state-sponsored advanced persistent threat (APT)of this report, if the GPT was recoverable, then it is listed as notgroups affiliated with the Russian Main Intelligence Directorate
affected. In the instance of DesertBlade, public samples were not(GRU), such as Sandworm, have consistently engaged in cyberavailable and open-source reporting was limited; therefore, it isoperations against important domestic sectors in Ukraine, such
unknown at the time of this writing whether the wiper affected
as the electric power grid in both 2015 and 2016 (1, 2), as well
MBR or GPT-style partition tables. The Associated Ransomware
as “utility companies, banks, airports, and government agencies”
column indicates whether a fake ransomware component wasin 2017. Following the launch of Russia’s full-scale invasion anddelivered as part of the wiper’s attack. Finally, the Target OS
subsequent war in Ukraine, Sandworm and other likely GRUand Languages columns describe the intended victim operating
affiliated threat activity groups again engaged in attempts tosystem (OS) and the programming language used to develop
deploy cyber attacks in concert with military operations against
the wipers.
Ukrainian entities, most recently via the deployment of a seriesof unsuccessful data wiping attacks. This report explores themalware, its timing, and the tactics, techniques, and procedures(TTPs) involved with these wiper attacks, and what this means
for the overall conflict.
Malware

MBR

GPT

Files

AssociatedRansomware

Target OS

WhisperGate

Y

NY

Y

Windows

HermeticWiper

N**

N**Y

Y

WindowsC, Assembly

IsaacWiper

Y

N**N

N

WindowsC, C++, Assembly

DesertBlade?

?

Y

N

Windows

GolangACIDRAIN*

N/A

N/A

Y

N

Linux (MIPS)C

CaddyWiper

Y

N

Y

N

Windows

C

DoubleZero

N**

N**Y

N

Windows.NET

AwfulShred

Y

Y

Y

NLinuxBash

SoloShred

Y

Y

Y

N

SolarisBash

Languages
C++ (Stage 1).NET (Stage 2, 3)

Table 1: High-level overview of each wiper’s functionality (Source: Recorded Future)* ACIDRAIN targets satellite modems, not desktop operating systems, so some fields may not be relevant.
** Although the MBR/GPT may be recoverable (or not affected at all), the wiper destroys the filesystem or critical files that prevent the system from successfully booting.

www.recordedfuture.com | Recorded Future ®

MTP-2022-0512

2

MALWARE/TOOL PROFILE

Figure 1: Timeline of when wipers were first identified in the wild, compilation date of the binaries, and certificate issue/revoke dates overlaid with key dates in the Ukraine/Russia conflict(Source: Recorded Future)

Finally, the destructive capabilities of these wipers
designed to target Windows and Unix-like systems, including
The wipers did not share code between them and were Surfbeam2 and Surfbeam2+ satellite modems, combined withwritten in various programming languages, suggesting they were the discriminant targeting of largely Ukrainian entities, further
distinct tools, possibly written by different developers. Over suggests that these efforts are almost certainly aligned withtime, the Windows wipers, as a whole, became less complex. Russian state-sponsored threat activity groups, likely in
The earliest wiper, WhisperGate, was the most sophisticated; affiliation with the Main Intelligence Directorate (GRU). Historicalit employed obfuscation, contained the most number of stages, attacks by GRU-attributed threat activity groups have heavily
masqueraded as ransomware, and downloaded its final stage targeted Ukrainian entities (1, 2), have included the use of falsefrom a remote server. Subsequent wipers, like HermeticWiper ransomware, such as the 2017 NotPetya and Bad Rabbit (1, 2)
and DoubleZero, present elements of these techniques, but not attacks, and have conducted known attacks that employed
all of them. However, these malicious tools do not approach the malware targeting Windows (1, 2) and Unix-like OSes (1, 2, 3, 4).
level of sophistication of suspected Russian state-sponsoredtools like Zebrocy, PowerDuke, or Havex.
WhisperGate

Overall Assessment

None of the wipers displayed network connectivity
WhisperGate, the first wiper to be associated with thecapabilities that would allow them to spread to other machines Ukraine/Russia conflict, is a 3-stage destructive malware thatoutside of the network (with only HermeticWizard having worm overwrites the MBR of a Windows machine. The first stagebehavior) or exfiltrate data, suggesting that the wipers had a overwrites the MBR (but is ineffective on GPT-style devices) andsingular purpose: to perform targeted destruction of particular displays a ransom note alleging that the victim’s hard drive hassystems (rather than espionage).
been corrupted and providing a Bitcoin wallet address to which
The earliest compilation date for these wipers was in mid- they should send payment. Subsequently, the malware deploys
October 2021 (IsaacWiper), 4 months before the first observation stage 2, which downloads the final stage of the malware that isof IsaacWiper’s use in the wild, and the certificates associated hosted on Discord’s content delivery network (CDN) as a JPG
with HermeticWiper were created in mid-April 2021, nearly 10 attachment and executes it. Stage 3 is a file corrupter that looks
months before the first observation of HermeticWiper’s use in the for files matching a list of 191 file extensions(such as .xlsx, .pdf,wild. This suggests that while the wipers were largely compiled and .zip) and overwrites the first 1MB of each with “0xCC” bytes.
close to the time when they were first used against Ukrainian
entities, some preparation occurred prior to the onset of theconflict. Overall, the use of the wipers escalated as the physicalconflict did, suggesting that these attacks were likely intended
to act as a force multiplier for ongoing kinetic operations.

3MTP-2022-0512

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOL PROFILE

HermeticWiper

ACIDRAIN

HermeticWiper and its purported ransomware component,
ACIDRAIN is a wiper malware targeting satellite modems
PartyTicket, are destructive malware that renders a victim’s used for internet access. On March 1, 2022, an American
Windows machine inoperable. The wiper is distributed by a telecommunications company that provides high-speed satellite
worm component known as HermeticWizard. HermeticWizard broadband services and secure networking systems covering
uses various means to identify IP addresses on the victim’s residential, commercial, and military markets, announced that
local network, and then spreads itself to new victims via the disruption of its satellite internet services in Ukraine andthe Windows Server Message Block (SMB) and Windows Europe, was caused by a cyberattack. This disruption coincided
Management Instrumentation (WMI) protocols, before finally with the Russian invasion of Ukraine.
executing HermeticWiper. HermeticWiper corrupts NTFS andThe company self-reported the incident, in which a modem
FAT file systems. Unlike WhisperGate, HermeticWiper does notwiper was employed to disrupt SurfBeam2 and SurfBeam2+corrupt the MBR or the GPT; it merely overwrites the filesystem.
modems and associated equipment used in KA-SAT deployments.
This allows HermeticWiper to succeed in its destructive
The wiper is tracked as ACIDRAIN (aka SKYFALL) and uses
capabilities against both types of file systems. The PartyTicket
multiple methods to overwrite the flash memory of the targeted“ransomware” component, like that of WhisperGate, is not true
device. When executed as root, ACIDRAIN performs an initial
ransomware. Unlike actual ransomware, PartyTicket does notrecursive overwrite and deletion of files located outside ofdisplay “branding” of any specific group and encrypts files thatstandard system directories before destroying the data ininclude executables such as .exe and .dll files that are criticalstorage devices.
to the computer’s ability to operate. This suggests that bothcomponents serve a destructive purpose, and are not likely to
CaddyWiper
be the work of a criminal threat actor.
CaddyWiper is a wiper malware targeting Windows systems.
The malware checks to see if it is running on the primary domain
IsaacWiper
controller and, if so, it simply exits. ESET speculated in a social
IsaacWiper attempts to overwrite all physical disks and logicalmedia post that this is to ensure that the threat actor does notvolumes of the victim machine, including the MBR. The wiper
lose their access to the victim’s network. If the victim machine
overwrites these disks and volumes with random data. Unlike
is not a primary domain controller then the wiper begins to
the previously released wipers, HermeticWiper and Whispergate,
recursively erase files located under the “C:\Users” directory,
IsaacWiper does not have a component that masquerades asfollowed by the contents of drives lettered D to Z. Each file isransomware.
overwritten with zeros to ensure that the data is destroyed andnot recoverable. Finally, the MBRs of the first 10 physical drives
DesertBladeconnected to the system (\\.\PhysicalDrive[0-9]) are overwritten
On March 1, 2022, suspected Russian threat actors used with zeros via an input/output control (IOCTL) call for IOCTL_
DesertBlade in an attack on a major broadcasting company. DISK_SET_DRIVE_LAYOUT_EX.
Microsoft reports that DesertBlade was used again duringthe week of March 17-23, but at the time of this report has DoubleZero
not provided any additional details. In the initial incident, theIn mid-March 2022, DoubleZero emerged, targeting Windowsmalware was reportedly deployed via an Active Directory Groupsystems. DoubleZero was discovered by CERT-UA (Ukraine’s
Policy Object (GPO), indicating that the attacker had first gained
cyber security intelligence agency) inside a zipped file named
control of the Active Directory for the network. DesertBlade“Virus ... extremely dangerous !!!. Zip”. The malware was written
overwrites files on the victim machine and then deletes them.
in .NET and progressively destroys data on a victim system,
The extra step of overwriting the files is likely performed in anstarting with non-system files and then shifting to system files
attempt to ensure that the files cannot be recovered.
and registry entries. Files are destroyed either via an IOCTL callfor FSCTL_SET_ZERO_DATA or by overwriting the file’s first 4096
bytes with zeros. Once the wiping process is complete, the victimmachine is rebooted. Microsoft reports that they have observed
DoubleZero used in attacks against Ukrainian broadcast andmedia organizations.

www.recordedfuture.com | Recorded Future ®

MTP-2022-0512

4

MALWARE/TOOL PROFILE

AwfulShred
AwfulShred is one of the Linux wipers associated with thethwarted Industroyer2 attack on a Ukrainian energy provider inearly April 2022. It is a Bash script distributed by OrcShred, aworm component used in the attack to spread the Linux wiper toother systems. In the early April attack, the OrcShred malware
created a cron job (scheduled task) to execute AwfulShred on
April 8, 2022, at 2:58 PM UTC. Upon execution, the task firststops and disables HTTP and SSH services, then deletes thecontents of the /boot, /home, and /var/log directories. It thenerases all attached disks using the “shred” or “dd” (copy andconvert) utility. When more than 1 disk is present, the disks arewiped simultaneously. Upon completion, a system reboot isissued.

SoloShred
SoloShred is a Bash script that is similar to AwfulShred andwas intended to target Solaris operating systems in the failed
Industroyer2 attack in early April 2022. It begins by stoppingand disabling any services that start with “ssh”, “http”, “apache”,“ora_”, or “oracle”. Next, databases on the system are deleted,and then /boot, /home, and /var/log along with any file paths
present in environment variables starting with “ORA” aredestroyed using the shred and “rm” (remove files) utilities. Alldisks on the system are wiped simultaneously using the shred
utility, in a similar manner to AwfulShred.

5

MTP-2022-0512

Recorded Future ® | www.recordedfuture.com

MALWARE/TOOL PROFILE

Outlook
Destructive data wipers against Ukrainian targets, coincident
with kinetic operations by Russia, were frequently deployed
between the end of February through late March of 2022; thecadence of new wiper attacks appeared to slow down in April.
While it is certainly possible that the Ukraine/Russia conflictcontinues to have a cyber component and other malware is
being used at this time, actions in the conflict appear to belargely kinetic for now. On April 27, Microsoft indicated that thewiper attacks were primarily conducted by the GRU; Microsoft
attributed the FoxBlade and CaddyWiper attacks to Sandworm/
Unit 74455, and WhisperGate to DEV-0586 (also a suspected
GRU-affiliated entity). While no attribution for the other wipers
has been made at this time, based on the victimology andobjectives achieved it is likely that Russian-aligned threat
activity groups are behind these wipers as well. Based on
historical precedent and the activity described in this report,
Russian-aligned groups will almost certainly continue to view
destructive cyber operations as useful force multipliers in theirwar against Ukraine and more destructive malware attacks arelikely as the conflict persists.

www.recordedfuture.com | Recorded Future ®

MTP-2022-0512

6

MALWARE/TOOL PROFILE

About Insikt Group®
Insikt Group is Recorded Future’s threat research division, comprising analysts andsecurity researchers with deep government, law enforcement, military, and intelligenceagency experience. Their mission is to produce intelligence on a range of cyber andgeopolitical threats that reduces risk for clients, enables tangible outcomes, and prevents
business disruption. Coverage areas include research on state-sponsored threat groups;
financially-motivated threat actors on the darknet and criminal underground; newly
emerging malware and attacker infrastructure; strategic geopolitics; and influence
operations.

About Recorded Future
Recorded Future is the world’s largest intelligence company. The Recorded
Future Intelligence Platform provides the most complete coverage across adversaries,
infrastructure, and targets. By combining persistent and pervasive automated datacollection and analytics with human analysis, Recorded Future provides real-time visibility
into the vast digital landscape and empowers clients to take proactive action to disrupt
adversaries and keep their people, systems, and infrastructure safe. Headquartered in
Boston with offices and employees around the world, Recorded Future works with morethan 1,300 businesses and government organizations across 60 countries.
Learn more at recordedfuture.com and follow us on Twitter at @RecordedFuture.

7

MTP-2022-0512

Recorded Future ® | www.recordedfuture.com