H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

WhisperGate

[WhisperGate](https://attack.mitre.org/software/S0689) is a multi-stage wiper designed to look like ransomware that has been used against multiple government, non-profit, and information technology organizations in Ukraine since at least January 2022.(Citation: Cybereason WhisperGate February 2022)(Citation: Unit 42 WhisperGate January 2022)(Citation: Microsoft WhisperGate January 2022)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[WhisperGate](https://attack.mitre.org/software/S0689) is a multi-stage wiper designed to look like ransomware that has been used against multiple government, non-profit, and information technology organizations in Ukraine since at least January 2022.(Citation: Cybereason WhisperGate February 2022)(Citation: Unit 42 WhisperGate January 2022)(Citation: Microsoft WhisperGate January 2022)

Labels

malware
29 recorded

Relationships

uses
from Ember Bear
Group
uses
to Bootkit
Technique
uses
to Create Process with Token
Technique
uses
to Data Destruction
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Disable or Modify Tools
Technique
uses
to Disk Content Wipe
Technique
uses
to Disk Structure Wipe
Technique
uses
to Encrypted/Encoded File
Technique
uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to InstallUtil
Technique
uses
to Local Storage Discovery
Technique
uses
to Masquerading
Technique
uses
to Native API
Technique
uses
to Network Share Discovery
Technique
uses
to PowerShell
Technique
uses
to Process Hollowing
Technique
uses
to Reflective Code Loading
Technique
uses
to Security Software Discovery
Technique
uses
to Service Execution
Technique
uses
to System Checks
Technique
uses
to System Shutdown/Reboot
Technique
uses
to Time Based Checks
Technique
uses
to Visual Basic
Technique
uses
to Web Protocols
Technique
uses
to Web Service
Technique
uses
to Windows Command Shell
Technique
4 external

References

mitre-attack
S0689
open
Cybereason WhisperGate February 2022
https://www.cybereason.com/blog/cybereason-vs.-whispergate-wiper
open
Unit 42 WhisperGate January 2022
https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/#whispergate-malware-family
open
Microsoft WhisperGate January 2022
https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance