ZOV
ZOV is a destructive wiper malware family attributed by ESET to the Russia-aligned Sandworm threat group with high confidence. It has been used against Ukrainian targets, including a Ukrainian energy company on January 25, 2024, and a financial institution in Ukraine in November 2025. Reporting states that ZOV wipes files on fixed drives, skips specific directories, and uses size-based overwrite logic. ESET also notes that Sandworm typically deploys ZOV via Active Directory Group Policy using a PowerShell deployment script from a shared network directory, an approach that generally requires Domain Admin privileges. ZOV is described as closely related in tactics and coding patterns to the later DynoWiper malware, with analysts highlighting strong similarities between the two families. The available content does not provide specific ZOV file hashes or broader IOC sets beyond these behavioral characteristics and victimology.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ESET attributes the malware to the Russia-aligned threat group Sandworm with medium confidence, noting shared tactics and coding patterns with previous destructive wiper families like ZOV.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previous destructive wiper family referenced as sharing tactics and coding patterns with DynoWiper.
Previously observed destructive wiper used against Ukrainian targets; referenced as similar to DynoWiper (including a dropped wallpaper artifact).
Destructive wiper that iterates over files on fixed drives and overwrites contents (full overwrite for smaller files; partial overwrite for larger files) using a buffer (commonly starting with the string 'ZOV'), then executes commands to remove files/directories and reboot; also drops a wallpaper image.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.