Loading malware…
HermeticWiper is a destructive Windows wiper first identified in February 2022 during attacks against organizations in Ukraine. Its purpose is data destruction and operational disruption rather than monetization. The malware was deployed against Ukrainian computers and websites and was observed alongside a separate pseudo-ransomware component, commonly referred to as PartyTicket, which appears to have served as a diversion from the underlying wiping activity.
HermeticWiper abuses a legitimately signed disk-management driver associated with EaseUS software to obtain privileged raw disk access. It enables the privileges needed to load the driver and perform shutdown-related actions, deploys an embedded driver variant appropriate to the victim system, and communicates with that driver to access physical drives directly. It disables crash dump generation and the Volume Shadow Copy Service, reducing recovery options and hindering forensic analysis. The malware then corrupts boot-related data and filesystem structures on both NTFS and FAT volumes, writes garbage data to disk, and wipes content from important user and system locations including user documents, desktop data, application data, and Windows event logs. Its final action is to force system shutdown, leaving affected hosts unusable and typically requiring operating system reinstallation.
The malware demonstrates deliberate destructive engineering rather than conventional espionage or ransomware tradecraft. Its use of signed components and privileged disk access supports defense evasion and reliable low-level destruction. Public reporting has tied HermeticWiper to the broader wave of disruptive cyber operations targeting Ukraine at the outset of Russia's full-scale invasion.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Associated Analytic Story Data Destruction Hermetic Wiper Windows Persistence Techniques Windows Privilege Escalation
24 distinct techniques documented for this family, organized by ATT&CK tactic.
The malware disables CrashDumpEnabled... The malware changes it to 0x0... After the clean up process, the malware disables Volume Shadow Copy Service (VSS) on the system, via Service Control Manager.
Powershell Fileless Process Injection via GetProcAddress ... T1055, T1059.001
The malware begins by obtaining a handle to the current process’ token... This allows the malware to change privileges assigned to the token.
The AdjustTokenPrivileges API is used to adjust the current token privileges... SeShutdownPrivilege SeBackupPrivilege
Powershell Fileless Script Contains Base64 Encoded Content ... T1027, T1059.001
Powershell Enable SMB1Protocol Feature ... T1027.005 ... Powershell Creating Thread Mutex ... T1027.005, T1059.001
Powershell Fileless Process Injection via GetProcAddress ... T1055, T1059.001
As soon as the driver starts running on the target system, it starts the clean up process by deleting the service entry in the registry, and the driver image in the C:\Windows\system32\drivers directory.
it starts the clean up process by deleting the service entry in the registry, and the driver image in the C:\Windows\system32\drivers directory.
The malware begins by obtaining a handle to the current process’ token... This allows the malware to change privileges assigned to the token.
It abuses the driver loaded to the target system, to access its hard disk with higher privileges and to write garbage data into it. The malware then renders the system useless by corrupting booting data.
Hermetic Wiper appears to have been used in conjunction with another malware family that disguises itself as ransomware. This secondary malware known as PartyTicket... takes a single command-line argument, which is the filename to encrypt... PartyTicket enumerates all files... Before file encryption, the targeted file is renamed... Files are encrypted with AES in GCM mode... The ransom note is written to the user’s desktop using the filename read_me.html.
After the clean up process, the malware disables Volume Shadow Copy Service (VSS) on the system... passing the 0x00000004 flag ( SERVICE_DISABLED ) to ChangeServiceConfigW, thus disabling VSS by force.
However, the execution of one of the threads performs InitiateSystemShutdownEx , which is a privileged activity, as the final damage.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an associated analytic story; no further details are provided in the content.
Referenced as an analytic story associated with PowerShell DownloadString behavior.
Named as an associated analytic story; no behavioral details about the malware itself are provided in this reference.
Associated Analytic Story Data Destruction ... Hermetic Wiper ... Log4Shell CVE-2021-44228
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.