HermeticWiper

Description

HermeticWiper is a data wiper used since early 2022, primarily against Ukraine with additional activity in Latvia and Lithuania. Its campaigns have hit government, financial, defense, aviation, and IT services sectors, and it renders victim systems unbootable by destroying file system structures.

Stats

First seen: February 2022
Last seen: October 2026

MITRE ATT&CK techniques

26 techniques across 6 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API
T1569System Services
- T1569.002Service Execution

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.015Compression
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1070Indicator Removal
- T1070.004File Deletion
T1134Access Token Manipulation
T1140Deobfuscate/Decode Files or Information
T1497Virtualization/Sandbox Evasion
- T1497.003Time Based Checks

TA0007 Discovery

T1082System Information Discovery
T1083File and Directory Discovery
T1680Local Storage Discovery

TA0040 Impact

T1485Data Destruction
T1489Service Stop
T1490Inhibit System Recovery
T1529System Shutdown/Reboot
T1561Disk Wipe
- T1561.002Disk Structure Wipe
- T1561.001Disk Content Wipe

TA0112 Defense Impairment

T1112Modify Registry
T1484Domain or Tenant Policy Modification
- T1484.001Group Policy Modification
T1553Subvert Trust Controls
- T1553.002Code Signing
T1685Disable or Modify Tools
- T1685.005Clear Windows Event Logs

Alert name variants

Alert Name	Engine
Generic.HermeticWiper.A.3CB2FF40	AV
Generic.HermeticWiper.A.6E99D0F3	AV
Generic.HermeticWiper.A.A7E4AE5D	AV
Generic.HermeticWiper.A.C91D4560	AV
GenPack:Generic.HermeticWiper.A.A26DB151	AV
Trojan.HermeticWiper.A	AV
Trojan.HermeticWiper.B	AV
Win32.Trojan.HermeticWiper	ATP Sandbox Adv. Heuristics