Newly identified wiper malware “Path Wiper” targets critical infrastructure in Ukraine
Summary: Cisco Talos detailed PathWiper, wiper malware that reaches endpoints through an administrative tool's console, which pushes a batch file executing a VBScript called 'uacinstall.vbs' that writes and runs the PathWiper executable named 'sha256sum.exe'. PathWiper enumerates connected storage media, queries the registry for shared network drive paths, dismounts volumes via FSCTL_DISMOUNT_VOLUME, and overwrites file system artifacts and files with randomly generated bytes, with filenames and actions mimicking the administrative utility's console.
What you should know: The attackers had prior knowledge of the victim's administrative console and used its own naming conventions as cover, and the wiper reaches shared network drives as well as local volumes - so the tooling trusted to manage endpoints became the delivery path for destruction.
Read the original at Cisco Talos ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026