Loading malware…
IsaacWiper is a destructive Windows wiper malware family written in C++ and used in targeted attacks against Ukrainian organizations during the opening phase of Russia’s 2022 invasion of Ukraine. It is one of several distinct wipers deployed in that conflict, alongside families such as HermeticWiper, CaddyWiper, WhisperGate, and DoubleZero, and has been associated with activity tracked by CERT-UA as UAC-0082.
IsaacWiper is designed to render systems and data unusable rather than support monetization. It enumerates physical and logical drives, gathers disk geometry and free-space information, and attempts to lock volumes before overwriting content. The malware overwrites the beginning of physical drives and then proceeds to wipe drives and files using data generated by a Mersenne Twister pseudorandom number generator. When direct access to files or volumes is blocked, it falls back to renaming files and creating temporary hidden directories and files to consume remaining free space until volumes are exhausted. Reported samples also create a log file during execution.
The malware targets Windows systems and operates at the disk and filesystem level through native device and volume control operations. Its behavior reflects a straightforward sabotage objective focused on destruction of host data and system availability. IsaacWiper has been publicly reported in campaigns against Ukrainian government and other organizations in the broader context of Russia-linked destructive cyber operations accompanying the war. No strong code similarity has been established between IsaacWiper and other Ukraine-focused wipers such as CaddyWiper or HermeticWiper, indicating it is a distinct malware family despite overlapping operational goals.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In 2022, the Russian APT used multiple wipers in attacks aimed at Ukraine, including AwfulShred, CaddyWiper, HermeticWiper, Industroyer2, IsaacWiper, WhisperGate, Prestige, RansomBoggs, and ZeroWipe.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Following the creation of the log file, the wiper enumerates all physical drives on the target system... IsaacWiper checks the resulting physical drive list... With a list of disk objects, IsaacWiper leverages IOCTL_DISK_GET_DRIVE_GEOMETRY_EX and GetDiskFreeSpaceExW() to obtain the size and available free space of each disk.
The resources below detail destructive malware used to destroy an organization’s critical assets and data.
The malware was designed to wipe the Master Boot Record, MBR, and proceed to corrupt the files on disk, destroying all traces of the data.
Many wipers also make sure to overwrite the Master Boot Record (MBR) of the disk.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Wiper malware targeting Ukrainian government networks during the pre-invasion cyber campaign.
Mentioned in a list of wipers observed after AcidRain.
A wiper malware referenced in the dataset generation context for Windows, associated here with DLL RawDiskRead activity.
Destructive wiper used in attacks (noted in 2022 activity).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.