WiperATT&CK S0697
HermeticWiper
Also known as: DriveSlayer, Trojan.Killdisk
HermeticWiper is destructive malware found on systems in Ukraine on 23 February 2022, the eve of Russia's full-scale invasion. It was signed with a legitimate code-signing certificate and used a legitimate disk driver to corrupt data and stop machines from booting. CISA and the FBI issued a joint advisory on it and related wipers.
- Public attribution and associated actors
- The cited CISA and ESET sources do not attribute HermeticWiper to a named actor; this page makes no attribution.
- First seen
- 2022
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0697 HermeticWiper
How it spreads or gets in
- Deployed by operators already inside victim networks, in some cases through Group Policy, and in others with a companion worm component (ESET).
Key behaviours
- Abused a legitimate signed disk-management driver for raw disk access.
- Corrupted the master boot record, partitions and file data.
- Forced a reboot so the damage took effect.
ATT&CK techniques
- T1553.002Subvert Trust Controls: Code Signing
- T1484.001Domain or Tenant Policy Modification: Group Policy Modification
- T1543.003Create or Modify System Process: Windows Service
- T1485Data Destruction
- T1561.001Disk Wipe: Disk Content Wipe
- T1561.002Disk Wipe: Disk Structure Wipe
- T1490Inhibit System Recovery
- T1529System Shutdown/Reboot
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Alert on new kernel drivers being loaded, especially disk drivers not used in your estate.
- Monitor Group Policy changes that deploy executables or scheduled tasks.
- Detect raw disk writes by user-mode processes.
Defences that work
- Use a vulnerable and unwanted driver blocklist and restrict driver installation.
- Protect Group Policy editing rights and monitor them.
- Keep offline backups and rehearse rebuilds for geopolitical high-risk periods.