Loading malware…
HermeticWiper is a destructive Windows wiper first identified in February 2022 during attacks against organizations in Ukraine. Its purpose is data destruction and operational disruption rather than monetization. The malware was deployed against Ukrainian computers and websites and was observed alongside a separate pseudo-ransomware component, commonly referred to as PartyTicket, which appears to have served as a diversion from the underlying wiping activity.
HermeticWiper abuses a legitimately signed disk-management driver associated with EaseUS software to obtain privileged raw disk access. It enables the privileges needed to load the driver and perform shutdown-related actions, deploys an embedded driver variant appropriate to the victim system, and communicates with that driver to access physical drives directly. It disables crash dump generation and the Volume Shadow Copy Service, reducing recovery options and hindering forensic analysis. The malware then corrupts boot-related data and filesystem structures on both NTFS and FAT volumes, writes garbage data to disk, and wipes content from important user and system locations including user documents, desktop data, application data, and Windows event logs. Its final action is to force system shutdown, leaving affected hosts unusable and typically requiring operating system reinstallation.
The malware demonstrates deliberate destructive engineering rather than conventional espionage or ransomware tradecraft. Its use of signed components and privileged disk access supports defense evasion and reliable low-level destruction. Public reporting has tied HermeticWiper to the broader wave of disruptive cyber operations targeting Ukraine at the outset of Russia's full-scale invasion.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Associated Analytic Story Data Destruction Hermetic Wiper Windows Persistence Techniques Windows Privilege Escalation
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Recon Using WMI Class ... T1592, T1059.001 ... WMI Recon Running Process Or Services ... T1592
PowerShell 4104 Hunting ... T1059.001 ... Malicious PowerShell
The malware uses OpenProcessToken API... AdjustTokenPrivileges API... VerifyVersionInfoW API... CreateServiceW... StartServiceW... DeviceIOControl API
The malware disables CrashDumpEnabled... The malware changes it to 0x0... After the clean up process, the malware disables Volume Shadow Copy Service (VSS) on the system, via Service Control Manager.
Annotations ID Technique Tactic T1543 Create or Modify System Process Persistence
If the service does not exist... new service is created via CreateServiceW... The StartServiceW API is then used to run the driver on the target system.
Powershell Fileless Process Injection via GetProcAddress ... T1055, T1059.001
The malware begins by obtaining a handle to the current process’ token... This allows the malware to change privileges assigned to the token.
The AdjustTokenPrivileges API is used to adjust the current token privileges... SeShutdownPrivilege SeBackupPrivilege
Annotations ID Technique Tactic T1543 Create or Modify System Process Persistence
If the service does not exist... new service is created via CreateServiceW... The StartServiceW API is then used to run the driver on the target system.
Powershell Fileless Script Contains Base64 Encoded Content ... T1027, T1059.001
Powershell Enable SMB1Protocol Feature ... T1027.005 ... Powershell Creating Thread Mutex ... T1027.005, T1059.001
Executables Or Script Creation In Temp Path ... T1036
Powershell Fileless Process Injection via GetProcAddress ... T1055, T1059.001
As soon as the driver starts running on the target system, it starts the clean up process by deleting the service entry in the registry, and the driver image in the C:\Windows\system32\drivers directory.
it starts the clean up process by deleting the service entry in the registry, and the driver image in the C:\Windows\system32\drivers directory.
The malware begins by obtaining a handle to the current process’ token... This allows the malware to change privileges assigned to the token.
The AdjustTokenPrivileges API is used to adjust the current token privileges... SeShutdownPrivilege SeBackupPrivilege
The version of the system is enumerated using VerifyVersionInfoW API. The malware selects the payload to be dropped based on the bitness (32/64).
The malware disables CrashDumpEnabled... The malware changes it to 0x0... After the clean up process, the malware disables Volume Shadow Copy Service (VSS) on the system, via Service Control Manager.
The Hermetic Wiper malware binary uses a signed digital certificate issued to “Hermetica Digital Ltd’ and the driver dropped by the malware has a signed digital certificate issued to “Chengdu Yiwo Tech Development Co Ltd” to circumvent security checks.
Unloading AMSI via Reflection ... T1059.001, T1562 Malicious PowerShell
The version of the system is enumerated using VerifyVersionInfoW API. The malware selects the payload to be dropped based on the bitness (32/64).
Associated Analytic Story Winter Vivern ... Ingress Tool Transfer ... Hermetic Wiper ... Malicious PowerShell ... HAFNIUM Group ... IcedID
It abuses the driver loaded to the target system, to access its hard disk with higher privileges and to write garbage data into it. The malware then renders the system useless by corrupting booting data.
Hermetic Wiper appears to have been used in conjunction with another malware family that disguises itself as ransomware. This secondary malware known as PartyTicket... takes a single command-line argument, which is the filename to encrypt... PartyTicket enumerates all files... Before file encryption, the targeted file is renamed... Files are encrypted with AES in GCM mode... The ransom note is written to the user’s desktop using the filename read_me.html.
After the clean up process, the malware disables Volume Shadow Copy Service (VSS) on the system... passing the 0x00000004 flag ( SERVICE_DISABLED ) to ChangeServiceConfigW, thus disabling VSS by force.
However, the execution of one of the threads performs InitiateSystemShutdownEx , which is a privileged activity, as the final damage.
The malware then accesses the Master Boot Record via \\.\PhysicalDrive0... The data corruption logic distinguishes NTFS and FAT systems... parses Master File Record fields such as $bitmap and $logfile
Before shutting down the system, the malware enumerates the following directories for data wiping: My Documents Desktop AppData Windows Event Logs
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.