Loading story…
Researchers analyzed multiple COVID-themed Windows malware samples, including CoViper and Covid22, that use pandemic-related lures before deploying destructive components that overwrite the Master Boot Record (MBR) and leave systems unable to boot. In the CoViper case, a PureBasic installer drops several files, creates a hidden %HOMEDRIVE%\COVID-19 folder, establishes persistence, disables Task Manager and some UAC protections, changes the wallpaper and cursor, and repeatedly displays a nuisance GUI. Its end.exe payload reads \\.\PhysicalDrive0, replaces the MBR with attacker code, and shows a taunting message on reboot, with language-specific text for German systems.
Fortinet reported a related sample, Covid22, posing as a fake installer and dropping WipeMBR.exe, which overwrites the first 512 bytes of the MBR without encrypting or stealing files, making the malware destructive but not ransomware. Analysts noted CoViper also backs up the original MBR and contains a hidden recovery shortcut using CTRL+ALT+ESC, suggesting unfinished development or experimentation. Defenders were provided hashes, YARA rules, and recovery guidance, including Windows repair options and the command:
bootrec.exe /fixmbr
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
FortiGuard Labs reported a new Windows malware sample named Covid22 that masquerades as a fake installer, drops several files, and executes WipeMBR.exe to overwrite the first 512 bytes of the Master Boot Record with zeros. The analysis said the malware does not encrypt, steal, or ransom files, and advised using Windows recovery tools such as bootrec.exe /fixmbr to restore affected systems.
A separate technical analysis documented a COVID-19-themed malware sample that extracts components from its resources, creates a hidden %HOMEDRIVE%\COVID-19 folder, disables Task Manager, and uses end.exe to overwrite the MBR with a malicious boot sector and reboot message. The write-up also published hashes and YARA rules for the malware's GUI, runner, and MBR-killing modules.
Avast published an analysis of the CoViper malware family, describing a COVID-19-themed installer that drops multiple components, disables protections, changes system settings, and overwrites the Master Boot Record to make systems unbootable. The report also noted the malware backs up the original MBR and includes a hidden restoration failsafe.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
fortinet.com
Open sourcetccontre.blogspot.com
Open sourcedecoded.avast.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a renewed **Rovnix** malware campaign that used coronavirus-themed documents referencing a World Bank initiative to lure victims into opening a self-extracting archive. The package delivered a decoy file alongside a dropper that unpacked updated Rovnix-derived components, then used a **UAC bypass** based on a fake trusted directory and **DLL hijacking** via `wusa.exe` and a malicious `wtsapi32.dll` to gain execution while evading defenses. The malware then installed a **bootkit** by overwriting the **VBR**, deployed the **KLoader** driver to inject a loader into running processes, and sent XOR-encrypted system data to command-and-control servers. Researchers also identified related loader variants that reused the same privilege-escalation technique without the bootkit, as well as payloads that acted as a backdoor capable of executing files, recording microphone audio, and rebooting or shutting down infected systems, indicating that leaked Rovnix source code had been adapted into a more modern intrusion toolset.
Aug 14, 2026
A COVID-19-themed malware campaign used a fake WiseCleaner download site at **`wisecleaner[.]best`** to deliver a loader named **`WSHSetup.exe`**, which fetched both **CoronaVirus ransomware** and the **Kpot** information stealer from **`trynda[.]xyz`** and related domains. Researchers reported that Kpot executed first, harvesting credentials and other sensitive data from browsers, VPN, RDP, email, chat, FTP, and cryptocurrency wallets before contacting attacker-controlled infrastructure and deleting itself, indicating that data theft was a primary objective of the intrusion. CoronaVirus ransomware then encrypted files with AES, appended the prefix **`coronavi2022@protonmail.ch___`** to filenames, dropped a ransom note named **`CoronaVirus.txt`**, and demanded a relatively small Bitcoin payment via contact address **`coronaVi2022@protonmail.ch`**. The malware also modified the **MBR**, registered pre-boot execution through the **`BootExecute`** registry value, displayed lock-screen ransom messages before Windows loaded, and attempted to hinder recovery by deleting shadow copies and backups, leading analysts to assess that the ransomware likely served in part as cover for the broader Kpot credential-theft operation.
Aug 15, 2026
Microsoft disclosed a destructive Go-based Windows backdoor dubbed **GigaWiper** that has been observed in compromised environments since October 2025, combining espionage, remote access, and sabotage functions in a single modular implant. The malware supports about 20 command codes and can wipe physical disks, overwrite the Windows drive, trigger BSOD-based disruption, clear event logs, manipulate processes, services, and the registry, capture screenshots, record screens, and provide hidden VNC-like remote control. It also masquerades as OneDrive and uses **RabbitMQ**, **Redis**, and in some reporting **MinIO** for command, result handling, and data exfiltration. Microsoft said GigaWiper appears to be assembled from at least three malware families, with code overlaps linking it to **Crucio** and **FlockWiper** and references to a broader framework labeled **GRAT**. One destructive component mimics ransomware by encrypting files without preserving a recovery key, making restoration impossible except from clean backups, while another performs multi-pass secure wiping. Separate reporting said the same hashes and command-and-control infrastructure matched Binary Defense's earlier **BLUERABBIT** findings, and cited broader research associating related tooling with likely Iran-linked operations targeting Israeli organizations, though Microsoft did not publicly attribute the activity to a country.
Jul 17, 2026