Threat Advisory: Hermetic Wiper
Summary: Cisco Talos reported a second wave of wiper attacks inside Ukraine using new malware dubbed HermeticWiper, with deployment beginning Feb. 23, 2022. The roughly 115KB executable carries a digital signature issued to "Hermetica Digital Ltd" valid from April 2021 to April 2022, targets the Master Boot Record and partitions, and uses four embedded resources that are compressed copies of drivers from the legitimate EaseUS Partition Master program.
Key Takeaway: One wiper sample was compiled as early as Dec. 28, 2021, indicating the attackers spent months developing it, and its abuse of legitimate signed drivers and IOCTLs can defeat detections that look for disk writes to partition tables.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026