A wiper is destructive malware designed to permanently erase or corrupt data and make systems unusable, rather than to steal information or extort money.
How wipers work
Wipers overwrite files with random data, destroy the master boot record or partition tables, corrupt firmware, or encrypt data with a key that is immediately thrown away. Some deliberately pose as ransomware and show a ransom note, although recovery is impossible – the “ransom” is only a cover for sabotage. Wipers are often deployed at the end of a long intrusion, after attackers have gained domain admin rights, so that they can hit thousands of machines at once.
Notable wiper attacks
- Shamoon (2012) – erased data on around 30,000 workstations at Saudi Aramco.
- NotPetya (2017) – spread through a compromised update of Ukrainian accounting software and caused damage that the US government estimated at about $10 billion worldwide.
- WhisperGate, HermeticWiper and others (2022) – a wave of wipers against Ukrainian organisations around the start of the Russian invasion; AcidRain disabled tens of thousands of satellite modems.
Why wipers matter
Wipers are a weapon of state-sponsored groups and APTs in geopolitical conflicts, but also of hacktivists and occasionally criminals. They target critical infrastructure, government and companies whose disruption has a political effect. There is nothing to negotiate: without backups, the data is gone.
How to prepare
- Keep offline or immutable backups and test restoring them regularly.
- Protect domain admin accounts and segment the network to limit the blast radius.
- Monitor for mass file changes and unusual use of admin tools such as Group Policy.
- Have an incident response plan for rebuilding systems from scratch.
Like other malware, wipers often arrive through vulnerable internet-facing systems or stolen credentials.
