HermeticWiper: Cyber Arson on Invasion Eve

Hours before Russian tanks rolled across Ukraine’s border on 24 February 2022, hundreds of Ukrainian organisations watched their Windows machines die. The destroyer was HermeticWiper — a data-destroying malware family named for the stolen code-signing certificate of its installer (issued to a Cypriot company, Hermetica Digital Ltd) that lent it an aura of legitimacy. First spotted in the wild on 23 February, it shredded master boot records and file systems with brutal efficiency, tailored for pure sabotage: no encryption, no ransom note, no data theft — just unrecoverable machines at ministries, banks, utilities, and logistics firms weeks into a broader campaign that also included a companion worm (HermeticWizard) for lateral spread and a decoy ransomware (HermeticRansom) seemingly designed to muddy attribution. HermeticWiper’s place in history was sealed by timing and scale: alongside the January 2022 WhisperGate attacks against Ukraine, it demonstrated that a modern invasion now opens with a cyber strike against the defender’s ability to see, communicate, and administer — and that wiper malware, the arson of the malware classes, had returned from 2017’s NotPetya era as a standing weapon of statecraft. For defenders everywhere, 23 February 2022 became the date that “destructive attack preparation” moved from threat-model footnote to publicly burned-in lesson.

What happened

The attack’s choreography read as military preparation. ESET and Microsoft telemetry caught HermeticWiper executions against multiple Ukrainian networks on 23 February at roughly 14:00 UTC — twelve-plus hours before the invasion’s first widely reported ground movements. The intrusions had the signature of long pre-positioning: adversary access to target networks existed well before deploy day (initial-access vectors were never conclusively published; suspected phishing, supply-chain touchpoints, and lingering credential access blended), meaning the wiper was the finisher, not the break-in.

Within the first 24 hours, researchers mapped the family: the digitally signed dropper (a stolen certificate lends OS trust and defeats naive “unsigned = suspicious” hygiene), the wiper core that abuses legitimate system drivers — a tactic echoing RobbinHood and old ransomware toolkits — to rewrite raw disk structures, and the companion pieces. HermeticWizard wormed across local networks via WMI and SMB to maximise blast radius; HermeticRansom posed as the motive, encrypting files with a theatrical bitcoin note, though its crudeness suggested camouflage more than commerce.

Ukraine’s continuity surprised observers conditioned by NotPetya’s 2017 devastation. Five years of institutional scar tissue — hardened backups, distributed infrastructure, wargamed response, a volunteer-heavy and battle-tested security community — meant the wiper hurt but did not blind. That resilience, not the malware’s failure, is the campaign’s most exportable lesson.

How it worked

HermeticWiper attack chain (2022-02):

  STAGE 0 - pre-positioning (weeks prior)
    initial access to target networks
    (concluded vector never published)
    implants + credential persistence
    staged for deploy-day

  STAGE 1 - execution (2022-02-23 ~14:00 UTC)
    signed installer runs
    - cert: Hermetica Digital Ltd
      (stolen/abused code-signing
      certificate, valid at the time)
    drops malicious DLL (the wiper core)

  STAGE 2 - driver abuse for raw disk access
    installs a vulnerable-but-legitimate
    (or forged) driver to gain kernel-level
    raw read/write to disks
    (tactic lineage: 2019-2021 ransomware
    toolkits; bypasses OS file protections)

  STAGE 3 - destruction
    overwrites MBR / partition structures
    and files on local + network drives
    targets specific file types + system
    structures for max unrecoverability

  STAGE 4 - lateral spread (HermeticWizard)
    WMI + SMB based worming inside LAN
    to reach every machine possible

  STAGE 5 - cover story (HermeticRansom)
    decoy ransomware family deployed
    on some targets; bitcoin note as
    false-flag/motive camouflage

The standfirst-level takeaway for practitioners: every stage is a detection opportunity that was NOT novel. Signed-binary abuse → certificate monitoring and reputation-aged-signature alerts. Driver installation → the modern endpoint baseline that all driver-loads on servers justify themselves. Wiper execution → low-frequency-but-high-fidelity behavioural rules (mass file overwrite, MBR writes) that need to page someone at 2am. The campaign’s components were all catalogued classes; what was new was their orchestration under invasion timing.

Impact and numbers

Timeline

Why it still matters in 2026

Because the fusion of cyber and kinetic war it debuted has only formalised, and because wipers came for everyone afterward. 2023–2025 saw destructive malware in every major theatre — against Israeli organisations at October 2023’s outbreak, inside Ukraine continuously, and in the low-grade wiper harassment of unaligned states’ infrastructure — each campaign reusing HermeticWiper’s grammar: ready access, driver abuse, decoy families, invasion-synced timing. Meanwhile Ukraine’s defence became the world’s live curriculum: its backup discipline, distributed-by-default infrastructure, and state-adjacent volunteer response showed measurable continuity under total assault, and its practices diffused into national guidance and NATO hardening baselines. Deterrence lessons also crystallised: the cost of the cyber opening was absorbed, the war continued, and the threshold for state destructive attack is now demonstrably lower than the pre-2022 consensus assumed — a fact every national CSIRT plan and grid-operator tabletop written since quietly encodes. For a 2026 reader, HermeticWiper is the reference organism for the entire destructive-malware genus: know its stages, and you know the shape of the next one, whoever signs the installer.

Detection and hardening takeaways

• Assume the wiper’s pre-positioned. Destructive attacks end intrusions, they don’t start them; hunt for persistence and credential harvesting in your estate with the seriousness of someone whose MBR depends on it — because it does.
• Test restoration, not backup existence. Ukraine endured because restoration was rehearsed under duress; an untested backup is a prayer, not a control. Quarterly restore drills with offline/immutable copies are the wiper’s true antidote.
• Alert on driver loads, MBR/partition writes, and mass-overwrite behaviour. These sparse-but-certain signals fire before the destruction completes; put them on paging paths with automatic host-isolation playbooks.
• Monitor code-signing reputation. A valid, freshly-used certificate on an unknown binary — especially installer-class — deserves quarantine-by-default treatment; stolen certs turn your trust infrastructure into their camouflage.
• Segment to shrink blast radius. HermeticWizard’s LAN worming reminds that flat networks convert one foothold into building-wide damage; ruthless segmentation of OT, admin, and server vlans is tedious and decisive.
• Plan for decoy families. HermeticRansom-style false flags exist to waste your response hours; incident-response runbooks should include a “is the ransomware a cover for a wiper?” triage branch before assuming a negotiable criminal incident.

FAQ

Was HermeticWiper ransomware?

No. It exclusively destroyed. The HermeticRansom companion that appeared on some targets displayed a ransom note and encrypted some files, but researchers judged it a decoy — deployed to make the campaign look criminal rather than state-directed — and it was never a functional monetisation channel. Treating the event as “ransomware” misreads both the intent and the correct defence posture.

Why “Hermetic”?

From the code-signing certificate on the installer: issued to Hermetica Digital Ltd, a Cypriot company whose certificate was stolen or otherwise abused to sign the malware. Naming malware families after their signing certificates is researcher convention (cf. “Evil Corp” loader naming patterns), and the stolen cert is itself the lesson: valid signatures add trust, so defenders must layer reputation and behaviour on top of signature validity.

Did the wiper “fail”?

Only if you measure by Ukrainian collapse, which didn’t happen. The malware worked technically — machines were destroyed at scale. Ukraine’s continuity owed to five years of post-NotPetya hardening: distributed systems, tested backups, a practiced security community, and infrastructure designed to degrade rather than die. The campaign is thus a double lesson: destructive attacks at invasion scale are survivable, and surviving them is the result of years of deliberate preparation, not incident-day heroics.

Wiper doctrine at invasion scale

HermeticWiper — deployed across Ukrainian organizations in the invasion opening hours — marked the doctrine shift this series treats at national-scale: wipers as military operations, executed alongside kinetic campaigns, targeting government and critical infrastructure with destruction rather than extortion as the objective. The technical details (signed driver delivery for low-level disk destruction) mattered less than the operational context: attribution tied to state conflict, timing tied to invasion logistics, and the target population tied to war aims rather than criminal economics.

The doctrine for defenders in every country that took notes: wiper preparation differs from ransomware preparation — there is no negotiation window, no decryptor, and no restore-later logic; recovery is the entire game, and offline-and-tested backups (the Guardian capacity) are the only control that answers destruction. The Ukrainian experience — repeated wiper waves absorbed over years with increasing operational resilience — remains the largest live demonstration of backup doctrine under sustained destructive attack, and the resilience curve of that population is the strongest empirical argument in the record for the controls this series assigns.

The consolidation: HermeticWiper opened the era of conflict-aligned cyber operations that subsequent years extended — and the sector lesson is the dependency map at national scale, the concentration thread in geopolitical form. Wipers target the single points of failure; the defense is the same map the incident-response doctrine assigns, which is why preparedness against destruction and preparedness against extortion converge on the same architecture: redundancy, isolation, rehearsal.

Related Reading

• What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
• Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)
• 2022–2024: Lapsus$, Change Healthcare & the XZ Backdoor
• Authoritative reference: CISA Known Exploited Vulnerabilities

More on this topic

• DP World Australia: When a Cyber Incident Stopped the Cranes
• Change Healthcare ALPHV: The Ransomware That Broke US Healthcare
• Guardian Ransomware: The Newsroom That Kept Printing

Published by Hmmnm

Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths — written and lab-tested by the Hmmnm team.

Learning Paths · About Hmmnm · Editorial policy