Malware

Swift Slicer

Swift Slicer is a destructive Windows wiper used in targeted intrusions to render systems inoperable by overwriting critical files, including Windows drivers and other important system data. The malware has been associated with attacks against organizations in Ukraine and is characterized by impact-focused behavior rather than espionage or monetization through encryption. Its destructive activity is comparable to other modern wipers such as CaddyWiper.

Observed deployment involved delivery through Group Policy Objects, indicating use after the attackers had already compromised the victim Active Directory environment and obtained sufficient administrative control to push the malware across Windows hosts. This makes Swift Slicer primarily a post-compromise destructive payload used late in the intrusion lifecycle. Its operational objective is system disruption and data destruction, with file-overwriting behavior intended to leave affected machines unbootable or otherwise unusable.

Swift Slicer is notable as a targeted enterprise wiper rather than commodity malware. Defensive monitoring has focused on behaviors consistent with destructive file operations on Windows endpoints, including unusual file overwrite or deletion patterns that may precede or accompany broad operational disruption.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1543Create or Modify System ProcessEvidence1

Annotations ID Technique Tactic T1543 Create or Modify System Process Persistence

Privilege Escalation

2 techniques

T1484.001Group Policy ModificationEvidence1

This malware like Caddy Wiper was deliver through GPO which suggests that the attacker had taken control of the victims active directory environment.

T1543Create or Modify System ProcessEvidence1

Annotations ID Technique Tactic T1543 Create or Modify System Process Persistence

Stealth

1 technique

T1036MasqueradingEvidence1

Executables Or Script Creation In Temp Path ... T1036

Defense Impairment

1 technique

T1484.001Group Policy ModificationEvidence1

This malware like Caddy Wiper was deliver through GPO which suggests that the attacker had taken control of the victims active directory environment.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

Leverage searches that allow you to detect and investigate unusual activities that might relate to the swift slicer malware including overwriting of files and etc.

Impact

1 technique

T1485Data DestructionEvidence2

Swift Slicer is one of Windows destructive malware found by ESET that was used in a targeted organizarion to wipe critical files like windows drivers and other files to destroy and left the machine inoperable.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

splunk researchNews

May 13, 2026

Detection: Suspicious Process File Path | Splunk Security Content

Associated Analytic Story ... Crypto Stealer Azorult Swift Slicer AgentTesla Qakbot Remcos ...

splunk researchNews

Feb 12, 2026

Detection: Windows High File Deletion Frequency | Splunk Security Content

Destructive malware/wiper referenced as associated with file deletion activity.

splunk researchNews

Aug 12, 2025

Xmrig Miner | Splunk Security Content

Swift Slicer is referenced as destructive malware in suspicious execution and driver-loading detections.

splunk researchNews

Feb 2, 2023

Swift Slicer | Splunk Security Content

A named malware sample referenced in a Splunk attack simulation dataset. Based on the name and public usage, Swift Slicer is a destructive wiper malware.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Swift Slicer