Hours before Russian tanks rolled across Ukraine’s border on 24 February 2022, hundreds of Ukrainian organisations watched their Windows machines die. The destroyer was HermeticWiper — a data-destroying malware family named for the stolen code-signing certificate of its installer (issued to a Cypriot company, Hermetica Digital Ltd) that lent it an aura of legitimacy. First spotted in the wild on 23 February, it shredded master boot records and file systems with brutal efficiency, tailored for pure sabotage: no encryption, no ransom note, no data theft — just unrecoverable machines at ministries, banks, utilities, and logistics firms weeks into a broader campaign that also included a companion worm (HermeticWizard) for lateral spread and a decoy ransomware (HermeticRansom) seemingly designed to muddy attribution. HermeticWiper’s place in history was sealed by timing and scale: alongside the January 2022 WhisperGate attacks against Ukraine, it demonstrated that a modern invasion now opens with a cyber strike against the defender’s ability to see, communicate, and administer — and that wiper malware, the arson of the malware classes, had returned from 2017’s NotPetya era as a standing weapon of statecraft. For defenders everywhere, 23 February 2022 became the date that “destructive attack preparation” moved from threat-model footnote to publicly burned-in lesson.
HermeticWiper is destructive malware deployed against Ukrainian organisations starting 2022-02-23, hours before Russia’s full-scale invasion. Mechanics: a signed installer (certificate of Hermetica Digital, stolen/abused) drops a malicious DLL whose payload corrupts local and network-accessible drives by abusing legitimate drivers to gain raw disk access, then overwrites key on-disk structures (MBR, partition/user files per its targeting routines) making machines unbootable and data unrecoverable. Family: pure wiper — no ransom demand, no C2 exfiltration; deployed with HermeticWizard (spreader) and HermeticRansom (decoy ransomware to confuse attribution/obscure the wiper’s role). Attribution: widely assessed by industry and government as Russian state-linked operationally aligned with the invasion; technical thread ties to earlier WhisperGate (2022-01) destructive activity. Impact: hundreds of Ukrainian entities hit across government, finance, energy, IT services; coordinated defence succeeded partially — Microsoft and others pushed detections and protections to defender ecosystems within hours, and Ukrainian continuity was maintained. Historical significance: first mass destructive cyber campaign synchronised with a conventional invasion at this scale; it established playbooks (pre-staged implants, legitimate driver abuse, code-signing theft, decoy families) that defenders now treat as the standard shape of state destructive attack.
What happened
The attack’s choreography read as military preparation. ESET and Microsoft telemetry caught HermeticWiper executions against multiple Ukrainian networks on 23 February at roughly 14:00 UTC — twelve-plus hours before the invasion’s first widely reported ground movements. The intrusions had the signature of long pre-positioning: adversary access to target networks existed well before deploy day (initial-access vectors were never conclusively published; suspected phishing, supply-chain touchpoints, and lingering credential access blended), meaning the wiper was the finisher, not the break-in.
Within the first 24 hours, researchers mapped the family: the digitally signed dropper (a stolen certificate lends OS trust and defeats naive “unsigned = suspicious” hygiene), the wiper core that abuses legitimate system drivers — a tactic echoing RobbinHood and old ransomware toolkits — to rewrite raw disk structures, and the companion pieces. HermeticWizard wormed across local networks via WMI and SMB to maximise blast radius; HermeticRansom posed as the motive, encrypting files with a theatrical bitcoin note, though its crudeness suggested camouflage more than commerce.
Ukraine’s continuity surprised observers conditioned by NotPetya’s 2017 devastation. Five years of institutional scar tissue — hardened backups, distributed infrastructure, wargamed response, a volunteer-heavy and battle-tested security community — meant the wiper hurt but did not blind. That resilience, not the malware’s failure, is the campaign’s most exportable lesson.
How it worked
HermeticWiper attack chain (2022-02):
STAGE 0 - pre-positioning (weeks prior)
initial access to target networks
(concluded vector never published)
implants + credential persistence
staged for deploy-day
STAGE 1 - execution (2022-02-23 ~14:00 UTC)
signed installer runs
- cert: Hermetica Digital Ltd
(stolen/abused code-signing
certificate, valid at the time)
drops malicious DLL (the wiper core)
STAGE 2 - driver abuse for raw disk access
installs a vulnerable-but-legitimate
(or forged) driver to gain kernel-level
raw read/write to disks
(tactic lineage: 2019-2021 ransomware
toolkits; bypasses OS file protections)
STAGE 3 - destruction
overwrites MBR / partition structures
and files on local + network drives
targets specific file types + system
structures for max unrecoverability
STAGE 4 - lateral spread (HermeticWizard)
WMI + SMB based worming inside LAN
to reach every machine possible
STAGE 5 - cover story (HermeticRansom)
decoy ransomware family deployed
on some targets; bitcoin note as
false-flag/motive camouflageThe standfirst-level takeaway for practitioners: every stage is a detection opportunity that was NOT novel. Signed-binary abuse → certificate monitoring and reputation-aged-signature alerts. Driver installation → the modern endpoint baseline that all driver-loads on servers justify themselves. Wiper execution → low-frequency-but-high-fidelity behavioural rules (mass file overwrite, MBR writes) that need to page someone at 2am. The campaign’s components were all catalogued classes; what was new was their orchestration under invasion timing.
Impact and numbers
| Metric | Value | Source |
|---|---|---|
| First seen | 2022-02-23 ~14:00 UTC | ESET/Microsoft telemetry |
| Invasion start | 2022-02-24 (hours later) | public record |
| Target scope | Hundreds of Ukrainian orgs: gov, finance, energy, IT, logistics | vendor + government reporting |
| Malware class | Pure wiper (no ransom, no C2 theft) | multiple AV analyses |
| Code signing | Stolen cert (Hermetica Digital Ltd) | ESET analysis |
| Companions | HermeticWizard (worm), HermeticRansom (decoy) | ESET/other analyses |
| Attribution | Russian state-aligned (wide industry/government assessment) | aggregated attribution record |
| Defender response | Detections/protections pushed within hours (Microsoft, ESET, peers) | vendor advisories |
Timeline
| Date | Event |
|---|---|
| 2022-01-13→14 | WhisperGate wiper + destructive attacks hit Ukrainian gov/agencies — opening moves |
| 2022-02-23 | HermeticWiper campaign executes across hundreds of Ukrainian orgs |
| 2022-02-24 | Full-scale invasion begins; cyber and conventional strikes coordinated |
| 2022-02→03 | Family fully analysed; protections industry-wide; Ukrainian continuity maintained |
| 2022-03+ | Further wiper variants hit Ukrainian/adjacent networks — campaign continues |
Why it still matters in 2026
Because the fusion of cyber and kinetic war it debuted has only formalised, and because wipers came for everyone afterward. 2023–2025 saw destructive malware in every major theatre — against Israeli organisations at October 2023’s outbreak, inside Ukraine continuously, and in the low-grade wiper harassment of unaligned states’ infrastructure — each campaign reusing HermeticWiper’s grammar: ready access, driver abuse, decoy families, invasion-synced timing. Meanwhile Ukraine’s defence became the world’s live curriculum: its backup discipline, distributed-by-default infrastructure, and state-adjacent volunteer response showed measurable continuity under total assault, and its practices diffused into national guidance and NATO hardening baselines. Deterrence lessons also crystallised: the cost of the cyber opening was absorbed, the war continued, and the threshold for state destructive attack is now demonstrably lower than the pre-2022 consensus assumed — a fact every national CSIRT plan and grid-operator tabletop written since quietly encodes. For a 2026 reader, HermeticWiper is the reference organism for the entire destructive-malware genus: know its stages, and you know the shape of the next one, whoever signs the installer.
Detection and hardening takeaways
- Assume the wiper’s pre-positioned. Destructive attacks end intrusions, they don’t start them; hunt for persistence and credential harvesting in your estate with the seriousness of someone whose MBR depends on it — because it does.
- Test restoration, not backup existence. Ukraine endured because restoration was rehearsed under duress; an untested backup is a prayer, not a control. Quarterly restore drills with offline/immutable copies are the wiper’s true antidote.
- Alert on driver loads, MBR/partition writes, and mass-overwrite behaviour. These sparse-but-certain signals fire before the destruction completes; put them on paging paths with automatic host-isolation playbooks.
- Monitor code-signing reputation. A valid, freshly-used certificate on an unknown binary — especially installer-class — deserves quarantine-by-default treatment; stolen certs turn your trust infrastructure into their camouflage.
- Segment to shrink blast radius. HermeticWizard’s LAN worming reminds that flat networks convert one foothold into building-wide damage; ruthless segmentation of OT, admin, and server vlans is tedious and decisive.
- Plan for decoy families. HermeticRansom-style false flags exist to waste your response hours; incident-response runbooks should include a “is the ransomware a cover for a wiper?” triage branch before assuming a negotiable criminal incident.
FAQ
Was HermeticWiper ransomware?
No. It exclusively destroyed. The HermeticRansom companion that appeared on some targets displayed a ransom note and encrypted some files, but researchers judged it a decoy — deployed to make the campaign look criminal rather than state-directed — and it was never a functional monetisation channel. Treating the event as “ransomware” misreads both the intent and the correct defence posture.
Why “Hermetic”?
From the code-signing certificate on the installer: issued to Hermetica Digital Ltd, a Cypriot company whose certificate was stolen or otherwise abused to sign the malware. Naming malware families after their signing certificates is researcher convention (cf. “Evil Corp” loader naming patterns), and the stolen cert is itself the lesson: valid signatures add trust, so defenders must layer reputation and behaviour on top of signature validity.
Did the wiper “fail”?
Only if you measure by Ukrainian collapse, which didn’t happen. The malware worked technically — machines were destroyed at scale. Ukraine’s continuity owed to five years of post-NotPetya hardening: distributed systems, tested backups, a practiced security community, and infrastructure designed to degrade rather than die. The campaign is thus a double lesson: destructive attacks at invasion scale are survivable, and surviving them is the result of years of deliberate preparation, not incident-day heroics.
