Threat Advisory: Double Zero
Summary: The Computer Emergency Response Team of Ukraine released an advisory on March 22, 2022 disclosing a .NET-based wiper dubbed "DoubleZero" targeting Ukrainian enterprises during Russia's invasion, with detection as early as March 17, 2022. The implant overwrites files with zero bytes via NtfsControlFile and FileStream routines, destroys registry hives after killing lsass processes, and shuts down the system with the ExitWindowsEx API call.
What you should know: This is the fourth wiper Cisco Talos names in Ukraine within two months, alongside CaddyWiper, HermeticWiper and WhisperGate, and DoubleZero deliberately destroys non-system files first so the machine is not bricked before user data is gone. A wiper built to leave nothing recoverable is a different problem from ransomware, which at least leaves you someone to negotiate with.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026