HermeticWiper
Software · ATTACK:enterprise:S0697
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0697",
"title": "HermeticWiper",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0697",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--a0ab8a96-40c9-4483-8a54-3fafa6d6007a",
"external_id": "S0697",
"domain": "enterprise",
"created": "2022-03-25T18:30:08.906Z",
"modified": "2025-10-21T23:23:39.286Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Trojan.Killdisk"
},
{
"source_name": "DriveSlayer"
},
{
"source_name": "CISA AA22-057A Destructive Malware February 2022",
"url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-057a"
},
{
"source_name": "Crowdstrike PartyTicket March 2022",
"url": "https://www.crowdstrike.com/blog/how-to-decrypt-the-partyticket-ransomware-targeting-ukraine"
},
{
"source_name": "Qualys Hermetic Wiper March 2022",
"url": "https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"
},
{
"source_name": "ESET Hermetic Wiper February 2022",
"url": "https://www.welivesecurity.com/2022/02/24/hermeticwiper-new-data-wiping-malware-hits-ukraine"
},
{
"source_name": "SentinelOne Hermetic Wiper February 2022",
"url": "https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack"
},
{
"source_name": "Symantec Ukraine Wipers February 2022",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
},
{
"source_name": "Crowdstrike DriveSlayer February 2022",
"url": "https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"
}
]
}Explicit source assertions (26)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e35d2ce-3af7-4645-b795-382a75d62fb9
Symantec Ukraine Wipers February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e44aa81-e454-4274-9fba-07fe3d3e3a0c
SentinelOne Hermetic Wiper February 2022 · Crowdstrike DriveSlayer February 2022 · Qualys Hermetic Wiper March 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1134
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a41b67c-60d5-4784-a5a8-99a60a3f9202
Qualys Hermetic Wiper March 2022 · Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1484.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b7d386f-57b6-4ed2-a5bf-bcc20c92c95b
ESET Hermetic Wizard March 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40ad3b2e-e88c-43a2-82c5-666e8ae568e4
ESET Hermetic Wizard March 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--415f38f8-d490-461a-9a40-968f8cd2bd8b
Symantec Ukraine Wipers February 2022 · Crowdstrike DriveSlayer February 2022 · ESET Hermetic Wiper February 2022 · Qualys Hermetic Wiper March 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41de9761-477c-4674-aea7-64a0b0b4ab4b
SentinelOne Hermetic Wiper February 2022 · Crowdstrike DriveSlayer February 2022 · Qualys Hermetic Wiper March 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1070
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42d6cd7c-a512-4fb9-a625-d21152b60f22
ESET Hermetic Wizard March 2022 · Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6435a96b-f3b5-4a16-876f-901650257d36
SentinelOne Hermetic Wiper February 2022 · Qualys Hermetic Wiper March 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a8db293-43a2-45a1-b9b2-32222355bc4e
SentinelOne Hermetic Wiper February 2022 · Symantec Ukraine Wipers February 2022 · Crowdstrike DriveSlayer February 2022 · Qualys Hermetic Wiper March 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ac34520-de4a-4033-92a4-52d7463592b9
Qualys Hermetic Wiper March 2022 · ESET Hermetic Wizard March 2022 · Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c56fdb0-d6cc-4a25-aa19-7191410704ef
Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8580c1e0-84fd-4da9-a9e8-1ae17f1b67d2
Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86e5bf16-825f-46d0-a590-57c134dd0b9a
ESET Hermetic Wizard March 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87a01c6d-b7a3-481f-82a9-5dee8c6f91db
Qualys Hermetic Wiper March 2022 · ESET Hermetic Wizard March 2022 · SentinelOne Hermetic Wiper February 2022 · Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--916e5e5c-7856-47e7-9749-58621671d158
Qualys Hermetic Wiper March 2022 · ESET Hermetic Wizard March 2022 · SentinelOne Hermetic Wiper February 2022 · Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2acfa7e-4ba4-42e0-ae13-068c17d7d7fa
Qualys Hermetic Wiper March 2022 · Symantec Ukraine Wipers February 2022 · Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a77ba502-576a-47cc-8718-c3f3dcc41b1e
Qualys Hermetic Wiper March 2022 · ESET Hermetic Wizard March 2022 · SentinelOne Hermetic Wiper February 2022 · Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abc4fb0a-cd49-438e-84bb-7000fbe48b1c
ESET Hermetic Wizard March 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1685.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c7fa894b-a6b9-47ba-83d4-596791518ba9
ESET Hermetic Wizard March 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd78a407-3770-4806-8b06-13b7f7ccc2cf
Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d02e8b78-69e7-4c70-bab1-a5bec9f94a9a
ESET Hermetic Wizard March 2022 · Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4ac896d-31ac-4c4a-a4d5-3134e6bd8622
Qualys Hermetic Wiper March 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d687171f-152f-4211-95bb-e051dc61575f
SentinelOne Hermetic Wiper February 2022 · Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db85221a-3d34-4e8d-bcb1-95b507617b84
Qualys Hermetic Wiper March 2022 · SentinelOne Hermetic Wiper February 2022 · Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f86b3fe5-c004-4fed-aaac-cf7d68b8d315
SentinelOne Hermetic Wiper February 2022 · Qualys Hermetic Wiper March 2022