An AI Based Solution to Detecting the Double Zero .NET Wiper
Summary: Unit 42 researchers built a machine learning model that scores .NET samples for maliciousness using features parsed from .NET-specific file structures, tested against a C# wiper named DoubleZero that Ukraine CERT disclosed in March 2022. DoubleZero wipes only the first 4096 bytes of selected files via FSCTL_SET_ZERO_DATA, kills any process named lsass, and leaves shadow copies intact, unlike HermeticWiper and LockBit.
What you should know: The standard PE-header signals defenders rely on yield little for .NET malware, so detection here rests on imported libraries, unmanaged ntdll.dll calls and plaintext target strings the actor left unencrypted. Because .NET files are ubiquitous in customer environments, the model must hold extremely low false positive rates while still catching a wiper built to destroy files and reboot the system.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026