Loading malware…
Meteor is a configurable Windows wiper used in the MeteorExpress operation that disrupted Iran’s railway system on July 9, 2021. Its primary purpose is destructive file wiping and disruption of system availability. It uses an encrypted JSON configuration to determine which locations to traverse and wipe, enabling its destructive behavior to be adapted to different environments.
Meteor can delete Volume Shadow Copies, disable recovery mode, alter boot configuration, and remove compromised machines from their domain to hinder restoration. Additional capabilities include changing local user passwords, logging off sessions, terminating selected processes, disabling network adapters through PowerShell, executing commands, creating scheduled tasks, and changing desktop wallpaper and lock-screen images. It can hide its console window, search for Kaspersky Antivirus, attempt to uninstall that product or remove its license, add attack-related files and folders to Microsoft Defender exclusions, and clear Windows event logs.
In the railway attack, operators abused Group Policy to distribute the toolkit within the compromised network. Batch scripts and compressed archives orchestrated deployment, and a scheduled task launched the wiper at a predetermined time. Meteor operated alongside a separate screen-locking component and scripts that impaired boot and recovery functionality. The operation targeted transportation infrastructure; its initial access vector and attribution to a known threat group were not established.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Shamoon 4.0 and Meteor are the primary destructive payloads assessed as active in the current conflict cycle.
"...including the 2021 railway system disruption using the Meteor wiper..."
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A destructive payload assessed as active in the current conflict cycle.
Destructive malware that hides its console window during execution to reduce visibility.
An Iran-linked wiper malware family referenced as part of a deliberate arsenal intended for destructive attacks and operational disruption.
Destructive wiper malware family referenced as part of Iran-aligned wiper tooling.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.