Loading malware…
SonicVote, also known as HermeticRansom, is destructive malware used in attacks against organizations in or tied to Ukraine during Russia’s 2022 invasion. Microsoft described FoxBlade and SonicVote as destructive malware discovered on 23 February 2022 that impacted hundreds of systems across government, IT, financial, and energy organizations predominantly located in or connected to Ukraine. The Canadian Centre for Cyber Security included SonicVote/HermeticRansom among eight malware families used by Russia-linked threat actors for destructive activity against Ukraine. The malware is associated in reporting with the Hermetic attack cluster alongside HermeticWiper/FoxBlade. Microsoft stated FoxBlade is also known as HermeticWiper/HermeticWizard and SonicVote as HermeticRansom; however, the provided content does not give further high-confidence technical details on SonicVote’s internal behavior, infection vector, or specific indicators of compromise beyond its naming and campaign context.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Following Russia’s invasion of Ukraine on 24 February 2022, likely Russian threat actors conducted several disruptive and destructive computer network attacks against Ukrainian targets... To date, there are eight tracked malware families that Russia-linked cyber threat actors have used for destructive activity against Ukraine: WhisperGate/Whisperkill, FoxBlade (HermeticWiper), SonicVote (HermeticRansom), CaddyWiper, DesertBlade, Industroyer2, Lasainraw (IsaacWiper) and FiberLake (DoubleZero).
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware-like destructive capability associated with the Hermetic wiper activity cluster.
SonicVote [[URL_b3187638_136]] 2022 年 4 月 (v 5.100)
Destructive malware tracked as HermeticRansom and used in Russia-linked operations against Ukraine.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.