Loading malware…
WhisperGate is a multistage destructive wiper targeting Windows systems that masquerades as ransomware. It was deployed against Ukrainian government agencies, nonprofit organizations, and information technology providers in January 2022, before Russia’s full-scale invasion of Ukraine. The campaign was initially tracked by Microsoft as DEV-0586 and subsequently associated with Cadet Blizzard, a Russian military intelligence threat actor linked to GRU Unit 29155.
WhisperGate overwrites the Master Boot Record with a fraudulent ransom note and deploys a separate file-corruption payload downloaded through legitimate Discord infrastructure. The payload overwrites files with selected extensions using repeated corruption bytes and assigns randomized extensions. Its destructive activity affects local disks, attached USB storage, and mounted network shares, rendering systems unbootable and data unusable rather than providing a genuine recovery mechanism.
The malware uses Windows command-shell and encoded PowerShell commands during execution. Its evasion techniques include disguising malicious executables as JPEG images, adding broad Microsoft Defender exclusions through Visual Basic scripting, and injecting a later-stage payload into a suspended process created by a legitimate Windows installation utility. It can use AdvancedRun to execute commands in the Windows TrustedInstaller security context and enumerate connected remote logical drives. The initial-access mechanism for the January 2022 deployment has not been established.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
WhisperGate is a two-stage wiper malware that masquerades as ransomware.
Vladislav Yevgenyevich Borovkov ... officier GRU affecté à l’Unité militaire 29155 ... associé à la campagne WhisperGate.
Recent cyber activity attributed to Russian State actors includes website defacement and wiper malware (WhisperGate) attacks.
The Conspirators infected computers on these and other networks with malware called WhisperGate, which was designed to look like ransomware. However, as the indictment alleges, WhisperGate was actually a cyberweapon designed to completely destroy the target computer and related data.
The group is also known to have performed the WhisperGate disruptive attack against the Ukrainian government entities in early 2022.
Starting on January 13th, 2022, several Ukrainian organizations were hit with a destructive malware now known as WhisperGate.
+2 more in the app. View in Mallory
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
The second stage ... download[s] an additional payload which corrupts files with extensions that are included in the list identified by Microsoft.
The first stage will overwrite the Master Boot Record (MBR) with a fraudulent ransom note containing instructions on how to recover data.
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
163 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.