Loading story…
Security researchers reported that RuRansom is a destructive malware strain aimed at systems geolocated in Russia, presenting itself as ransomware while functioning primarily as a wiper. The malware checks a victim’s public IP address through external services and exits unless the host appears to be in Russia, then seeks elevated privileges, scans local, removable, and network drives, deletes .bak backup files, and encrypts files with AES/AES-CBC while appending the .fs_invade extension. It also drops a Russian-language note stating there is no decryption or payment path, underscoring that the operation is intended to damage Russian victims rather than extort them.
Researchers said the malware is a .NET 32-bit PE sample that can spread in worm-like fashion across connected systems and USB devices, including by copying itself as Россия-Украина_Война-Обновление.doc.exe. Trend Micro linked RuRansom to the developer behind dnWipe and a downloader for XMRig, suggesting an actor experimenting with multiple destructive and financially motivated tools, while noting attribution remains unconfirmed. VMware and Cyble also described multiple variants that attempt privilege escalation and appear to have been developed during the Russia-Ukraine cyber conflict, with encrypted files considered effectively irreversible.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
VMware published a technical analysis of RuRansom describing its targeting of Russian systems, use of geolocation checks, propagation to removable and network drives, deletion of backup files, AES-based encryption, and politically motivated destructive ransom note. The report also released MITRE ATT&CK mappings, a YARA rule, and file hashes as indicators of compromise.
Cyble Research Labs published an analysis of RURansom as a wiper-ransomware hybrid observed attacking targets in Russia, detailing its Russia-only geolocation check, privilege escalation, worm-like spread, AES-CBC encryption, and deletion of .bak files. The report also noted similarities with dnWiper and cited Trend Micro's view that the same threat actors may be behind both.
Trend Micro reported that RURansom was targeting Russia, assessed it as wiper-like rather than true ransomware, and linked dnWipe and an XMRig downloader to the same developer. The researchers also said they had not identified any victims at the time and believed the malware was still under development.
RuRansom's ransom note says the malware author created RU_Ransom to harm Russia after Vladimir Putin declared war on Ukraine on February 24. This date is explicitly referenced in the malware's embedded message as the motivation for the attack.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 49 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
blogs.vmware.com
Open sourceblog.cyble.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Destructive malware operations against organizations in Ukraine included **CaddyWiper** and a separate pseudo-ransomware campaign that posed as extortion but was built to permanently destroy data. Researchers said CaddyWiper shared no code with earlier payloads such as **HermeticWiper**, but it similarly targeted user files, mapped drives, and disk partitions while avoiding execution on primary domain controllers through a domain-controller kill switch. U.S. authorities warned that multiple malware families were being used in coordinated attacks on Ukrainian networks, underscoring the risk of disruptive and irreversible data loss. Technical analysis showed the attacks relied on enterprise compromise and staged payload delivery rather than simple smash-and-grab deployment. CaddyWiper checked domain-controller status via the `DsRolePrimaryDomainInformation` API and wiped disks using low-level Windows functions, while defenders observed destructive payloads being pushed at scale through compromised **Group Policy Objects** after attackers obtained domain administrator access. In the pseudo-ransomware case, the intrusion chain used an MBR wiper, a downloader retrieving payloads from Discord CDN, a .NET loader that disabled Microsoft Defender and used process hollowing, and a final C-based wiper that overwrote files across 191 extensions before shutting systems down, leaving victims with no practical recovery path despite the ransom note.
Aug 15, 2026
Multiple destructive malware campaigns struck Ukraine around the start of Russia’s invasion, with **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, **WhisperGate**, and **DoubleZero** used against government, financial, and other organizations. Researchers reported that HermeticWiper corrupted boot records and partition data by abusing a legitimate EaseUS driver, while CaddyWiper and DoubleZero erased user data, partition information, and critical registry or boot components, often while deliberately sparing domain controllers to preserve attacker access. Several incidents appeared to follow prior compromise of victim networks, including abuse of **Active Directory**, scheduled execution, and in some cases worm-like spread via **HermeticWizard**; HermeticRansom was also deployed as a likely decoy alongside destructive activity. The destructive operations extended beyond enterprise Windows environments. **AcidRain** was used in the attack on Viasat’s **KA-SAT** network, wiping satellite modems in Ukraine and elsewhere in Europe by recursively destroying filesystems and storage devices, while the **Industroyer2** operation targeted a Ukrainian energy provider with malware built to communicate over **IEC-104** and cut power, paired with Windows, Linux, and Solaris wipers including **CaddyWiper**, **ORCSHRED**, **SOLOSHRED**, and **AWFULSHRED**. Across the reporting, defenders were urged to watch for mass file overwrites, shadow copy and event log deletion, MBR or partition changes, suspicious use of administrative tooling and group policy, and to maintain tested, isolated backups to recover from destructive attacks.
Aug 15, 2026
Researchers detailed multiple destructive malware families used against Ukrainian targets, linking **AcidRain**, **AcidPour**, and **CaddyWiper** to attacks designed to disable systems and erase data during Russia’s war against Ukraine. Trellix reported that AcidRain was used to disrupt Viasat **KA-SAT** satellite modems, while the newer Linux wiper **AcidPour** adds features including self-overwrite, a configurable execution delay, and recursive wiping of `/boot`. The firm assessed with medium confidence that AcidPour was derived from or closely modeled on AcidRain, and said the activity broadly aligns with a pro-Russian actor, though it did not attribute the attacks to a specific group. On the Windows side, Morphisec said **CaddyWiper** struck several dozen systems in a limited number of Ukrainian organizations and was likely deployed through **Group Policy Object**, indicating prior compromise of an **Active Directory** server. The malware was built to destroy user files and attached drives, and when executed with administrative privileges it also corrupts physical drive partition information, leaving the operating system unusable. Researchers noted that CaddyWiper selectively avoids damaging non-domain-controller systems and dynamically resolves Windows APIs through the **PEB** to hinder detection, placing it among a broader run of wipers including **WhisperGate**, **HermeticWiper**, and **IsaacWiper**.
Aug 14, 2026