Loading malware…
WhisperKill is a destructive Windows wiper associated with the January 2022 WhisperGate campaign targeting Ukrainian government and other Ukrainian organizations during the opening phase of Russia’s war against Ukraine. It is a C-language file wiper used alongside other destructive components in coordinated intrusions that also involved website defacement and, in some environments, manual destruction of virtual machines. WhisperKill was delivered by the WhisperGate malware chain and functioned as the file-corruption stage of that operation.
Its primary behavior is to overwrite files matching a predefined set of extensions on local fixed and remote drives with 1 MB blocks of 0xCC bytes, irreversibly destroying data rather than encrypting it for recovery. After execution, it self-deletes. Reporting has also noted code similarity or substantial code reuse with earlier destructive malware, including WhiteBlackCrypt and the Encrpt3d ransomware codebase, reinforcing assessment of it as a repurposed destructive tool rather than conventional ransomware.
WhisperKill formed part of a broader cluster of wiper activity directed at Ukraine in 2022, alongside families such as WhisperGate, HermeticWiper, IsaacWiper, CaddyWiper, and DoubleZero. Public reporting has linked its deployment to attacks on Ukrainian state entities, but definitive attribution to a specific state actor remains contested in open sources. The malware’s role, targeting, and timing place it within the wave of sabotage-oriented cyber operations aimed at disrupting Ukrainian government and organizational operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
WhisperKill: This malware, downloaded by WhisperGate, destroys files with specific extensions.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Wiper malware targeting Ukraine, mentioned as one of several destructive strains active during the invasion period.
Wiper malware deployed against Ukrainian organizations during the Ukraine-Russia war.
File wiper used during the WhisperGate campaign, designed to destroy data on targeted systems.
A wiper malware used in attacks against Ukraine; reported to reuse much of Encrpt3d/WhiteBlackCrypt ransomware code.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.