Threat intelligence / Malware

HermeticWiper

[HermeticWiper](https://attack.mitre.org/software/S0697) is a data wiper that has been used since at least early 2022, primarily against Ukraine with additional activity observed in Latvia and Lithuania. Some sectors targeted include government, financial, defense, aviation, and IT services.(Citation: SentinelOne Hermetic Wiper February 2022)(Citation: Symantec Ukraine Wipers February 2022)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: ESET Hermetic Wiper February 2022)(Citation: Qualys Hermetic Wiper March 2022)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[HermeticWiper](https://attack.mitre.org/software/S0697) is a data wiper that has been used since at least early 2022, primarily against Ukraine with additional activity observed in Latvia and Lithuania. Some sectors targeted include government, financial, defense, aviation, and IT services.(Citation: SentinelOne Hermetic Wiper February 2022)(Citation: Symantec Ukraine Wipers February 2022)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: ESET Hermetic Wiper February 2022)(Citation: Qualys Hermetic Wiper March 2022)

Labels

malware

26 recorded

Relationships

uses

to Access Token Manipulation

Technique

uses

to Clear Windows Event Logs

Technique

uses

to Code Signing

Technique

uses

Technique

uses

to Data Destruction

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to Disk Content Wipe

Technique

uses

to Disk Structure Wipe

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Group Policy Modification

Technique

uses

to Indicator Removal

Technique

uses

to Inhibit System Recovery

Technique

uses

to Local Storage Discovery

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Scheduled Task

Technique

uses

to Service Execution

Technique

uses

to Service Stop

Technique

uses

to System Information Discovery

Technique

uses

to System Shutdown/Reboot

Technique

uses

to Time Based Checks

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

10 external

References

mitre-attack

S0697

Trojan.Killdisk

—

DriveSlayer

—

CISA AA22-057A Destructive Malware February 2022

https://www.cisa.gov/uscert/ncas/alerts/aa22-057a

Crowdstrike PartyTicket March 2022

https://www.crowdstrike.com/blog/how-to-decrypt-the-partyticket-ransomware-targeting-ukraine

Qualys Hermetic Wiper March 2022

https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware

ESET Hermetic Wiper February 2022

https://www.welivesecurity.com/2022/02/24/hermeticwiper-new-data-wiping-malware-hits-ukraine

SentinelOne Hermetic Wiper February 2022

https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack

Symantec Ukraine Wipers February 2022

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia

Crowdstrike DriveSlayer February 2022

https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/