Loading story…
Researchers reported that Azov was not a conventional ransomware operation but a destructive polymorphic wiper designed to cause severe and often unrecoverable damage on Windows systems. The malware spread through the SmokeLoader botnet and trojanized software, then infected suitable 64-bit PE executables by injecting re-encrypted shellcode and appending encoded resources. Once active, Azov intermittently corrupted files by overwriting 666-byte blocks with random data and adding the .azov extension, while also maintaining persistence, using anti-analysis techniques, and relying on a time-based logic bomb.
Analysis found no evidence of network communications or data exfiltration, reinforcing the conclusion that Azov’s purpose was destruction rather than extortion. Check Point identified two closely related Azov variants and noted that more than 17,000 Azov-related samples had appeared on VirusTotal by late 2022, suggesting broad and indiscriminate propagation that obscured any original targeting. The malware was manually written in assembly with FASM and used a custom shellcode decryption routine, while its distribution through the SmokeLoader malware family helped amplify infections at scale.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Check Point Research reported that by November 2022 it had observed more than 17,000 Azov-related samples submitted to VirusTotal. The volume reflected widespread distribution that obscured any original targeting.
The analyzed newer Azov sample contained a time-based logic bomb set to begin its destructive routine at 10:14:30 AM UTC on October 27, 2022. After that trigger time, it traversed directories, intermittently overwrote file contents, and appended the .azov extension to wiped files.
Check Point Research published a technical report concluding that Azov was not conventional ransomware but an advanced polymorphic wiper. The report said Azov spread via SmokeLoader and trojanized software, backdoored 64-bit executables, and showed no network activity or data exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that **RuRansom** is a destructive malware strain aimed at systems geolocated in Russia, presenting itself as ransomware while functioning primarily as a wiper. The malware checks a victim’s public IP address through external services and exits unless the host appears to be in Russia, then seeks elevated privileges, scans local, removable, and network drives, deletes `.bak` backup files, and encrypts files with **AES/AES-CBC** while appending the `.fs_invade` extension. It also drops a Russian-language note stating there is no decryption or payment path, underscoring that the operation is intended to damage Russian victims rather than extort them. Researchers said the malware is a **.NET 32-bit PE** sample that can spread in worm-like fashion across connected systems and USB devices, including by copying itself as `Россия-Украина_Война-Обновление.doc.exe`. Trend Micro linked RuRansom to the developer behind **dnWipe** and a downloader for **XMRig**, suggesting an actor experimenting with multiple destructive and financially motivated tools, while noting attribution remains unconfirmed. VMware and Cyble also described multiple variants that attempt privilege escalation and appear to have been developed during the Russia-Ukraine cyber conflict, with encrypted files considered effectively irreversible.
Aug 15, 2026
Destructive malware operations against organizations in Ukraine included **CaddyWiper** and a separate pseudo-ransomware campaign that posed as extortion but was built to permanently destroy data. Researchers said CaddyWiper shared no code with earlier payloads such as **HermeticWiper**, but it similarly targeted user files, mapped drives, and disk partitions while avoiding execution on primary domain controllers through a domain-controller kill switch. U.S. authorities warned that multiple malware families were being used in coordinated attacks on Ukrainian networks, underscoring the risk of disruptive and irreversible data loss. Technical analysis showed the attacks relied on enterprise compromise and staged payload delivery rather than simple smash-and-grab deployment. CaddyWiper checked domain-controller status via the `DsRolePrimaryDomainInformation` API and wiped disks using low-level Windows functions, while defenders observed destructive payloads being pushed at scale through compromised **Group Policy Objects** after attackers obtained domain administrator access. In the pseudo-ransomware case, the intrusion chain used an MBR wiper, a downloader retrieving payloads from Discord CDN, a .NET loader that disabled Microsoft Defender and used process hollowing, and a final C-based wiper that overwrote files across 191 extensions before shutting systems down, leaving victims with no practical recovery path despite the ransom note.
Aug 15, 2026
Researchers detailed how **SmokeLoader** continues to operate as a heavily obfuscated, multi-stage malware loader that hides its execution flow and decrypts later payloads in memory before contacting command-and-control infrastructure. Reverse-engineering of recent samples showed opaque predicate obfuscation, encrypted functions, API hashing based on `djb2` with an added XOR layer, and a compressed third stage that is decrypted with XOR keys before being unpacked with **LZSA2**. Analysts also reported that the final decrypted stage can have a damaged PE header while retaining usable sections, complicating static analysis but still allowing recovery of configuration data such as RC4-encrypted strings and multiple C2 URLs. Separate analysis traced a Visual Basic Script infection chain that used `wscript.exe` to launch an obfuscated PowerShell downloader, which then fetched an executable from `americanocoffea[.]ru` into the victim's temp directory and executed it as a SmokeLoader payload. One investigated sample was observed delivering the **Vidar** infostealer, reinforcing SmokeLoader’s role as a malware distribution platform rather than a single-purpose implant. Public research from CERT Polska and independent analysts collectively highlights SmokeLoader’s layered packing, staged delivery, and reusable infrastructure as key factors that make the malware effective for initial access and follow-on payload deployment.
Aug 15, 2026