Loading story…
Researchers reported that HermeticWiper was deployed in destructive intrusions targeting Windows environments, alongside broader disruptive activity that included DDoS attacks, website defacements, mobile device management abuse, Microsoft SQL attacks, and a ransomware decoy. The malware was observed using a legitimately signed EaseUS Partition Master driver to gain low-level access to storage devices, then corrupting the MBR, boot sectors, and NTFS structures to make systems unbootable and unrecoverable.
Analysis indicates the campaign may have spread through Group Policy Object (GPO) deployment after initial access via exposed services or spear phishing, with operators also using web shells, schtasks, and PowerShell for persistence and privilege escalation. HermeticWiper additionally disabled crash dumps and protections tied to Volume Shadow Copy, while a related Golang ransomware component, tracked as HermeticRansom or PartyTicket, encrypted files with the .encryptedJB extension and dropped a read_me.html ransom note; security vendors said a decryptor for that ransomware component was available.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Splunk published technical analysis of HermeticWiper, describing its use of a signed EaseUS Partition Master driver, destructive disk and NTFS corruption behavior, and anti-forensic actions such as disabling crash dumps and VSS protections. The post also noted the wider campaign included DDoS attacks, web defacements, MDM and Microsoft SQL attacks, and a related ransomware decoy component called HermeticRansom or PartyTicket.
Avast released a free decryptor for HermeticRansom after researchers found the malware's flawed encryption logic failed to properly initialize its key, allowing recovery of files with the .encryptedJB extension. The tool incorporated a decryption script published by CrowdStrike and provided a GUI and usage instructions.
CrowdStrike analyzed the PartyTicket ransomware used alongside HermeticWiper in attacks on Ukrainian organizations and found implementation errors in AES key generation made its encryption superficial, slow, and breakable. The company published a script to recover encrypted files and assessed the ransomware was likely an additional destructive payload rather than a genuine extortion tool.
IBM Security X-Force published analysis of HermeticWiper after detections on Ukrainian organizations, detailing its use of a signed EaseUS Partition Manager driver, destructive disk and NTFS corruption behavior, and anti-recovery actions. IBM also released indicators of compromise and YARA rules, and later updated the report to include the PartyTicket ransomware deployed alongside the wiper.
SentinelOne published analysis of a new destructive malware family dubbed HermeticWiper and said it was being used in cyber attacks targeting Ukraine. The reporting tied the malware to a broader disruptive campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
11 references tracked. Mallory keeps watching after this page renders.
splunk.com
Open sourceblogs.vmware.com
Open sourcethreatpost.com
Open sourcedecoded.avast.io
Open sourcesecurityintelligence.com
Open sourcezscaler.com
Open sourcesentinelone.com
Open sourcecrowdstrike.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that systems hit by **HermeticWiper** were also presented with a fake ransomware operation dubbed **GoRansom**, but the ransom component appeared to be a distraction rather than a genuine extortion campaign. The attack combined destructive wiping activity with a ransom note, creating the appearance of financially motivated malware while the underlying objective was irreversible system damage. Analysis linked the incident to the broader **HermeticWiper** intrusion set, indicating that the so-called GoRansom element lacked the hallmarks of a normal ransomware deployment and instead served as cover for sabotage. The operation highlighted how threat actors can blend wiper malware with counterfeit ransom messaging to delay attribution, confuse responders, and mask a destructive attack as ordinary cybercrime.
Jul 12, 2026
Multiple destructive malware campaigns struck Ukraine around the start of Russia’s invasion, with **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, **WhisperGate**, and **DoubleZero** used against government, financial, and other organizations. Researchers reported that HermeticWiper corrupted boot records and partition data by abusing a legitimate EaseUS driver, while CaddyWiper and DoubleZero erased user data, partition information, and critical registry or boot components, often while deliberately sparing domain controllers to preserve attacker access. Several incidents appeared to follow prior compromise of victim networks, including abuse of **Active Directory**, scheduled execution, and in some cases worm-like spread via **HermeticWizard**; HermeticRansom was also deployed as a likely decoy alongside destructive activity. The destructive operations extended beyond enterprise Windows environments. **AcidRain** was used in the attack on Viasat’s **KA-SAT** network, wiping satellite modems in Ukraine and elsewhere in Europe by recursively destroying filesystems and storage devices, while the **Industroyer2** operation targeted a Ukrainian energy provider with malware built to communicate over **IEC-104** and cut power, paired with Windows, Linux, and Solaris wipers including **CaddyWiper**, **ORCSHRED**, **SOLOSHRED**, and **AWFULSHRED**. Across the reporting, defenders were urged to watch for mass file overwrites, shadow copy and event log deletion, MBR or partition changes, suspicious use of administrative tooling and group policy, and to maintain tested, isolated backups to recover from destructive attacks.
Aug 15, 2026
Destructive malware operations against organizations in Ukraine included **CaddyWiper** and a separate pseudo-ransomware campaign that posed as extortion but was built to permanently destroy data. Researchers said CaddyWiper shared no code with earlier payloads such as **HermeticWiper**, but it similarly targeted user files, mapped drives, and disk partitions while avoiding execution on primary domain controllers through a domain-controller kill switch. U.S. authorities warned that multiple malware families were being used in coordinated attacks on Ukrainian networks, underscoring the risk of disruptive and irreversible data loss. Technical analysis showed the attacks relied on enterprise compromise and staged payload delivery rather than simple smash-and-grab deployment. CaddyWiper checked domain-controller status via the `DsRolePrimaryDomainInformation` API and wiped disks using low-level Windows functions, while defenders observed destructive payloads being pushed at scale through compromised **Group Policy Objects** after attackers obtained domain administrator access. In the pseudo-ransomware case, the intrusion chain used an MBR wiper, a downloader retrieving payloads from Discord CDN, a .NET loader that disabled Microsoft Defender and used process hollowing, and a final C-based wiper that overwrote files across 191 extensions before shutting systems down, leaving victims with no practical recovery path despite the ransom note.
Aug 15, 2026