Loading malware…
SOLOSHRED is a destructive wiper used by the Sandworm threat group in coordinated attacks against Ukrainian critical infrastructure during 2022. It is one of several platform-specific wiping tools deployed alongside Industroyer2 and the Windows wiper CaddyWiper in an operation targeting a Ukrainian energy provider, where the combined objective was to disrupt electric power operations and hinder recovery by destroying supporting IT and Unix-like systems. SOLOSHRED is associated specifically with Solaris environments and is grouped with related non-Windows wipers such as ORCSHRED and AWFULSHRED.
The malware’s known role is destructive sabotage rather than espionage or monetization. In the April 2022 energy-sector intrusion attributed with high confidence to Sandworm, SOLOSHRED was used as part of a broader multi-platform attack that paired industrial-control-system disruption with wiping of enterprise assets. This tradecraft is consistent with Sandworm’s long-running pattern of destructive operations against Ukrainian infrastructure, especially the energy sector. Public reporting ties SOLOSHRED to the attempted disruption of high-voltage substations in Ukraine, where non-Windows wipers were intended to impede restoration efforts after the operational technology attack phase.
Available high-confidence reporting supports classifying SOLOSHRED as a Solaris wiper, but provides limited public technical detail on its internal implementation, propagation, persistence, or standalone delivery mechanism. Its observed use is best understood as a targeted destructive component within a larger Sandworm intrusion rather than a broadly distributed malware family.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In addition to Industroyer2, Sandworm used several destructive malware families including CaddyWiper, ORCSHRED, SOLOSHRED and AWFULSHRED.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Wiper used alongside Industroyer.V2 to target Solaris systems in an OT-related destructive attack.
Disk-wiping malware used against Linux or Solaris systems to destroy data and complicate restoration efforts.
Destructive malware family used by Sandworm alongside Industroyer2.
Solaris-targeting wiper (per IoCs) discovered in the Industroyer2-related Sandworm incident.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.