MITRE ATT&CKsoftware (malware)
S0697 HermeticWiper
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- Trojan.Killdisk, DriveSlayer
- Version
- 1.2
- Created
- 2022-03-25
Description
HermeticWiper is a data wiper that has been used since at least early 2022, primarily against Ukraine with additional activity observed in Latvia and Lithuania. Some sectors targeted include government, financial, defense, aviation, and IT services.
Related
Uses · MITRE ATT&CK (26)
- T1685 Disable or Modify Tools technique
- T1685.005 Clear Windows Event Logs sub-technique
- T1680 Local Storage Discovery technique
- T1027.015 Compression sub-technique
- T1484.001 Group Policy Modification sub-technique
- T1569.002 Service Execution sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.003 Time Based Checks sub-technique
- T1561.001 Disk Content Wipe sub-technique
- T1561.002 Disk Structure Wipe sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1553.002 Code Signing sub-technique
- T1070.004 File Deletion sub-technique
- T1543.003 Windows Service sub-technique
- T1053.005 Scheduled Task sub-technique
- T1529 System Shutdown/Reboot technique
- T1490 Inhibit System Recovery technique
- T1489 Service Stop technique
- T1485 Data Destruction technique
- T1134 Access Token Manipulation technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1070 Indicator Removal technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1106 Native API technique
- T1112 Modify Registry technique
References
- https://www.cisa.gov/uscert/ncas/alerts/aa22-057a CISA AA22-057A Destructive Malware February 2022
- https://www.crowdstrike.com/blog/how-to-decrypt-the-partyticket-ransomware-targeting-ukraine Crowdstrike PartyTicket March 2022
- https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware Qualys Hermetic Wiper March 2022
- https://www.welivesecurity.com/2022/02/24/hermeticwiper-new-data-wiping-malware-hits-ukraine ESET Hermetic Wiper February 2022
- https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack SentinelOne Hermetic Wiper February 2022
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia Symantec Ukraine Wipers February 2022
- https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/ Crowdstrike DriveSlayer February 2022