IsaacWiper

IsaacWiper is a destructive Windows wiper malware used against Ukraine in February 2022. Public reporting cited in the content states that a second destructive attack against a Ukrainian governmental network began on February 24, 2022 using IsaacWiper. ESET reported on March 1, 2022 that IsaacWiper targeted specific machines that had previously been compromised with the RemCom remote administration tool, which was used for lateral movement. The malware is consistently listed alongside other Ukraine-focused wipers such as WhisperGate, HermeticWiper, CaddyWiper, and DoubleZero, and multiple sources in the content place it within the broader wave of destructive operations aligned with Russia’s invasion of Ukraine. ESET’s broader reporting attributes the majority of these disruptive attacks in Ukraine to Sandworm with varying degrees of confidence, and later reporting lists IsaacWiper among multiple wipers used in attacks aimed at Ukraine by Russian actors. The content also notes that CaddyWiper bears no major code similarities to IsaacWiper, indicating IsaacWiper is a distinct malware family. A Splunk SnapAttack dataset referenced in the content simulates Windows IsaacWiper DLL RawDiskRead activity and maps it to MITRE ATT&CK technique T1006. High-confidence details in the provided content do not include specific file hashes or additional IoCs for IsaacWiper itself.