Loading story…
Cisco Talos disclosed a destructive intrusion against a Ukrainian critical infrastructure organization in which attackers deployed a newly identified wiper malware family, PathWiper, after allegedly gaining access to a legitimate endpoint administration framework. Talos said the operation bears strong similarities to prior Russia-linked attacks on Ukraine and assessed with high confidence that a Russia-nexus APT actor was responsible. The malware was launched via a dropped VBScript, uacinstall.vbs, which wrote sha256sum.exe to disk and then systematically corrupted physical drives, volumes, NTFS artifacts, and files with random data after attempting to dismount targeted volumes.
The reporting indicates the attackers used enterprise administration mechanisms to issue malicious commands and likely relied on established lateral movement techniques before the destructive phase. Related defensive research has highlighted how Microsoft Excel can be abused through DCOM for remote execution and lateral movement, and Splunk has published detection guidance for suspicious cases where Excel spawns unusual child processes, a pattern that can indicate Office-based execution or command-and-control activity. Talos noted that PathWiper shares semantic similarities with HermeticWiper but uses a more methodical drive and network-share discovery process, including enumeration of removed shared drives through the Windows registry.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the detection "Windows Excel ActiveMicrosoftApp Child Process" and replaced it with the renamed analytic "Windows Excel Spawning Microsoft Project Application" in content library version 5.26.0. The detection was associated with the PathWiper analytic story and mapped to DCOM lateral movement tradecraft.
Splunk Threat Research removed the deprecated detection analytic "Office Product Spawning CertUtil" from its content library because it no longer effectively identified the intended malicious activity. Splunk listed "Windows Office Product Spawned Uncommon Process" as the replacement and recorded the change in content library version 5.2.0.
Talos disclosed technical details on PathWiper's execution chain and destructive behavior, including its use of a VBScript dropper, the sha256sum.exe payload name, and overwriting of MBR and NTFS artifacts. Talos also published an indicator of compromise for the malware: 7C792A2B005B240D30A6E22EF98B991744856F9AB55C74DF220F32FE0D00B6B3.
SpecterOps published research describing lateral movement through abuse of the DCOM Excel Application. This research was later cited by Splunk in detection content مرتبط with PathWiper-related tradecraft.
Cisco Talos reported observing a destructive attack against a critical infrastructure entity in Ukraine and identified a previously unknown wiper malware family, which it named PathWiper. Talos said the attackers used a legitimate endpoint administration framework to issue malicious commands and deploy the wiper, and attributed the operation with high confidence to a Russia-nexus APT actor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceresearch.splunk.com
Open sourceblog.talosintelligence.com
Open sourcespecterops.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed multiple destructive malware families used against Ukrainian targets, linking **AcidRain**, **AcidPour**, and **CaddyWiper** to attacks designed to disable systems and erase data during Russia’s war against Ukraine. Trellix reported that AcidRain was used to disrupt Viasat **KA-SAT** satellite modems, while the newer Linux wiper **AcidPour** adds features including self-overwrite, a configurable execution delay, and recursive wiping of `/boot`. The firm assessed with medium confidence that AcidPour was derived from or closely modeled on AcidRain, and said the activity broadly aligns with a pro-Russian actor, though it did not attribute the attacks to a specific group. On the Windows side, Morphisec said **CaddyWiper** struck several dozen systems in a limited number of Ukrainian organizations and was likely deployed through **Group Policy Object**, indicating prior compromise of an **Active Directory** server. The malware was built to destroy user files and attached drives, and when executed with administrative privileges it also corrupts physical drive partition information, leaving the operating system unusable. Researchers noted that CaddyWiper selectively avoids damaging non-domain-controller systems and dynamically resolves Windows APIs through the **PEB** to hinder detection, placing it among a broader run of wipers including **WhisperGate**, **HermeticWiper**, and **IsaacWiper**.
Aug 14, 2026
Ukraine said Russia-linked threat groups intensified cyberattacks against its critical infrastructure, government, communications, energy, and humanitarian logistics networks, using phishing and multiple destructive malware families including **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, and **DoubleZero**. CERT-UA attributed activity during the period to several tracked clusters such as `UAC-0056`, `UAC-0051/UNC1151`, `UAC-0028/APT28`, and `UAC-0033/XDSpy`, and said the operations were tied to actors affiliated with Russian and Belarusian state structures and proxy entities. Ukrainian officials also reported targeting of organizations documenting war crimes and of European charities supporting refugees, underscoring that the campaign extended beyond domestic wartime targets. Researchers separately documented destructive intrusions in which **HermeticWiper** and **CaddyWiper** were deployed through Windows Group Policy after attackers had already gained broad control of victim networks. HermeticWiper hit finance organizations, government contractors, and other Ukrainian systems while also affecting some machines in Latvia and Lithuania; it corrupted local data and the master boot record, leaving devices unable to boot. In parallel, CERT-UA warned that phishing emails posing as antivirus updates delivered **Cobalt Strike** along with the **GraphSteel** and **GrimPlant** backdoors, a campaign linked with medium confidence to `UAC-0056`, showing that espionage, access operations, and destructive attacks were being conducted in tandem.
Aug 15, 2026
Trellix disclosed **PathWiper**, a destructive malware operation that abuses **DCOM** to move across Windows environments and trigger large-scale disk wiping. The activity was presented as a network erasure campaign rather than conventional ransomware, with the malware designed to render systems inoperable by corrupting or destroying data across affected hosts. The report highlights the use of legitimate Windows remote management mechanisms to propagate the wiper, underscoring how trusted administrative features can be turned into destructive tradecraft. For defenders, the findings point to the need for tighter controls on **DCOM** usage, stronger monitoring of lateral movement through native Windows components, and rapid containment of suspicious remote execution activity before wiping actions spread across the network.
Jul 12, 2026