HermeticWiper Attack Used Fake GoRansom Note as a Smokescreen
Threat Actor Intelligence · 1 source · Updated 4mo ago · First seen May 25, 2026
Researchers reported that systems hit by HermeticWiper were also presented with a fake ransomware operation dubbed GoRansom, but the ransom component appeared to be a distraction rather than a genuine extortion campaign. The attack combined destructive wiping activity with a ransom note, creating the appearance of financially motivated malware while the underlying objective was irreversible system damage.
Analysis linked the incident to the broader HermeticWiper intrusion set, indicating that the so-called GoRansom element lacked the hallmarks of a normal ransomware deployment and instead served as cover for sabotage. The operation highlighted how threat actors can blend wiper malware with counterfeit ransom messaging to delay attribution, confuse responders, and mask a destructive attack as ordinary cybercrime.
