The Demon WhisperGate, the Whisper Before the War

Legend

In mid-January 2022 it hit Ukrainian government and IT bodies, a few weeks before the Russian invasion. It posed as ransomware but overwrote the boot record and corrupted files with no chance of recovery. It was a message, not a demand for money.

Exorcism

Cast it out with offline backups and system images ready to restore. A ransom note with no credible way to pay is the sign of a disguised wiper.

Technical record

Circle: Circle IV · Destroyers (wipers) · Circle V · State espionage
First seen: 2022
Status: Dormant

A wiper disguised as ransomware that hit Ukrainian government and IT organisations in mid-January 2022, ahead of Russia's full-scale invasion. It overwrote the master boot record and corrupted files with no real recovery option. The US charged a Russian national and GRU officers in connection with it in 2024.

Sources: attack.mitre.org · justice.gov · MITRE ATT&CK reference S0689