The Demon HermeticWiper, on the Eve of the Invasion

Legend

On 23 February 2022, the eve of the Russian invasion, it was used against Ukrainian organisations. It abused a legitimately signed EaseUS partitioning driver to corrupt disks, sometimes alongside a decoy ransomware and a spreading component. Microsoft linked it, with moderate confidence, to a group the US government attributes to Russian military intelligence; ESET found no concrete link to a known group.

Exorcism

Cast it out by blocking vulnerable drivers even when signed and protecting domain administration tools. Offline backups and fast recovery plans limit the damage.

Technical record

Also known as: FoxBlade, KillDisk.NCV
Circle: Circle IV · Destroyers (wipers) · Circle V · State espionage
First seen: 2022
Status: Dormant
Works: Winter Darkness in Ukraine

A wiper deployed against Ukrainian organisations on 23 February 2022, the eve of Russia's invasion. It abused a legitimately signed EaseUS partition driver to corrupt disks and was sometimes paired with a decoy ransomware and a worm component. Microsoft linked it with moderate confidence to IRIDIUM (Sandworm), which the US attributes to GRU Unit 74455; some vendors and press linked it to Sandworm, while ESET found no tangible link to a known actor.

Sources: attack.mitre.org · cisa.gov · MITRE ATT&CK reference S0697