H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

HermeticWizard

[HermeticWizard](https://attack.mitre.org/software/S0698) is a worm that has been used to spread [HermeticWiper](https://attack.mitre.org/software/S0697) in attacks against organizations in Ukraine since at least 2022.(Citation: ESET Hermetic Wizard March 2022)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[HermeticWizard](https://attack.mitre.org/software/S0698) is a worm that has been used to spread [HermeticWiper](https://attack.mitre.org/software/S0697) in attacks against organizations in Ukraine since at least 2022.(Citation: ESET Hermetic Wizard March 2022)

Labels

malware
16 recorded

Relationships

uses
to Clear Windows Event Logs
Technique
uses
to Code Signing
Technique
uses
to Component Object Model
Technique
uses
to Encrypted/Encoded File
Technique
uses
to Lateral Tool Transfer
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Native API
Technique
uses
to Network Service Discovery
Technique
uses
to Password Guessing
Technique
uses
to Regsvr32
Technique
uses
to Remote System Discovery
Technique
uses
to Rundll32
Technique
uses
to Service Execution
Technique
uses
to SMB/Windows Admin Shares
Technique
uses
to Windows Command Shell
Technique
uses
to Windows Management Instrumentation
Technique
2 external

References

mitre-attack
S0698
open
ESET Hermetic Wizard March 2022
https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance