HermeticWiper Used in Destructive Attacks Against Windows Systems
Threat Actor Intelligence · 11 sources · Updated 3mo ago · First seen Mar 10, 2022
Researchers reported that HermeticWiper was deployed in destructive intrusions targeting Windows environments, alongside broader disruptive activity that included DDoS attacks, website defacements, mobile device management abuse, Microsoft SQL attacks, and a ransomware decoy. The malware was observed using a legitimately signed EaseUS Partition Master driver to gain low-level access to storage devices, then corrupting the MBR, boot sectors, and NTFS structures to make systems unbootable and unrecoverable.
Analysis indicates the campaign may have spread through Group Policy Object (GPO) deployment after initial access via exposed services or spear phishing, with operators also using web shells, schtasks, and PowerShell for persistence and privilege escalation. HermeticWiper additionally disabled crash dumps and protections tied to Volume Shadow Copy, while a related Golang ransomware component, tracked as HermeticRansom or PartyTicket, encrypted files with the .encryptedJB extension and dropped a read_me.html ransom note; security vendors said a decryptor for that ransomware component was available.
