Malware2 associated actors

Nemo Wiper

Tracked since Sep 11, 2026 · Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors2Associated

ATT&CK9Techniques

IOCs5Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Threat actors

Associated threat actors

2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details →

Ukrainian Cyber Alliance

In an operation with the Ukrainian Cyber Alliance, Hacking Cat deployed Nemo Wiper.

via the hacker newsthehackernews.com

Hacking Cat

In an operation with the Ukrainian Cyber Alliance, Hacking Cat deployed Nemo Wiper.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

4 techniques

T1112Modify RegistryEvidence1

Служба меняет HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR\Start на 4, блокируя загрузку USB Mass Storage; скрипт также включает AutoAdminLogon и Safe Mode with Networking.

T1136Create AccountEvidence1

LSAPlatformUpdate.ps1 создает нового локального пользователя и добавляет его в группу администраторов, затем включает AutoAdminLogon.

T1543.003Windows ServiceEvidence1

DLL регистрирует службу Windows LSANetLogin, указывая C:\ProgramData\nplsvc.exe как исполняемый файл службы.

T1556.008Network Provider DLLEvidence1

LSAPlatformUpdate.ps1 регистрирует LSANetLogin64w7.dll или LSANetLogin32w7.dll в качестве сетевого провайдера, который запускается после перезагрузки.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence1

DLL регистрирует службу Windows LSANetLogin, указывая C:\ProgramData\nplsvc.exe как исполняемый файл службы.

Defense Impairment

3 techniques

T1112Modify RegistryEvidence1

T1556.008Network Provider DLLEvidence1

T1685.005Clear Windows Event LogsEvidence1

Версия Monkey на C++ очищает журналы System, Security и Application, а PowerShell-цепочка отключает часть событий Windows PowerShell Event Log и очищает следы работы.

Credential Access

1 technique

T1556.008Network Provider DLLEvidence1

Discovery

1 technique

T1057Process DiscoveryEvidence1

Gorilla RAT поддерживает команду processes для получения списка процессов; nplsvc.exe перечисляет процессы для поиска explorer.exe.

Command and Control

1 technique

T1573Encrypted ChannelEvidence1

Адрес C2 Gorilla RAT зашифрован побайтовым преобразованием с четырехбайтовым ключом; DLL-компоненты расшифровывают полезные нагрузки ChaCha20 и XOR.

Impact

2 techniques

T1485Data DestructionEvidence4

Nemo Wiper “overwrites files with random bytes and fills the remaining free disk space with files containing random alphanumeric names and the .lock extension.”

T1489Service StopEvidence1

Перед уничтожением Nemo Wiper выполняет net stop для MSSQLSERVER, SQLSERVERAGENT, MySQL, PostgreSQL, MongoDB, Oracle, Docker, Hyper-V, vmms и Elasticsearch, а также wsl --shutdown.

Indicators of compromise

Observables

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

the hacker newsNews · Sep 16, 2026Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and WipersDestructive malware that overwrites files with random bytes and fills free disk space with randomly named files using the .lock extension.Read more ↗cysecurity newsNews · Sep 15, 2026Pro-Ukraine Hacking Cat Group Deploys New Malware Against Russian Targets - CySecurity News - Latest Information Security and Hacking IncidentsDestructive wiper used in a June 2026 operation against a heating provider. It erases data and is intended to disrupt critical infrastructure rather than generate ransom payments.Read more ↗the record mediaNews · Sep 14, 2026Pro-Ukraine Hacking Cat group deploying new malware against Russian targets | The Record from Recorded Future NewsDestructive wiper malware intended to destroy data and disrupt infrastructure rather than obtain ransom payments.Read more ↗securelist ruNews · Sep 11, 2026Разбираем инструментарий группировки Hacking Cat (Хакерский кiт) | SecurelistA destructive Windows wiper delivered through a malicious network-provider/DLL persistence chain found alongside Gorilla RAT in a victim environment. It stops services protecting database, virtualization, container, and WSL data; partially overwrites files with random data based on file size; and exhausts free disk space with random files to hinder recovery.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matching5Match every observed IP, domain, and hash against your live telemetry.

Associated threat actors2Groups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

Nemo Wiper

Tracked since Sep 11, 2026 · Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors2Associated

ATT&CK9Techniques

IOCs5Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure