For those who still think that ransomware attacks are the most malicious of all cyberattacks, it should be noted that the recent changes due to wiper malware have made this threat even more dangerous. With ransomware, one can at least retrieve the encrypted file after negotiations. However, the primary objective of wiper malware is to cause as much damage as possible rather than being satisfied with stealing money.
A stark recent example is the damage caused by Russia on Ukrainian government and banking websites — deploying wiper malware as a weapon of war rather than for financial gain.
How Wiper Malware Works
There are several variants of wiper malware, each with their own methodology. However, wiper malware mostly focuses on three critical areas: files, the system boot section, and the backup.
It may consume a lot of time to overwrite or delete all the files on a disk. To avoid wasting time, most wipers don't overwrite entire disk drives — instead they write small amounts of data randomly at specific intervals to destroy the files. Generally, the wiper focuses on files for essential system recovery tools first, to ensure as much damage as possible is inflicted with no option for recovery remaining.
Targeting the Master Boot Record (MBR)
Wiper malware's objective is to make data irrecoverable by eliminating it at the physical level of the disk. The most powerful way to eliminate data is by overwriting specific physical locations with other data. Since this process can be time-consuming, several wipers initially destroy two special files: the Master Boot Record (MBR) and the Master File Table (MFT).
The MBR is utilized during the boot process to identify where the operating system is stored on the disk. When the MBR is replaced, the boot process crashes — rendering all files inaccessible unless forensic techniques are used.
Targeting the Master File Table (MFT)
The MFT is present on every NTFS file system. It is essentially a catalog of all the files present on the file system, their metadata, and either the file content or where the content is stored. Once the MFT is corrupted, the operating system cannot locate any files. Wiper malware uses this technique to quickly make all files disappear without overwriting every byte of data.
Targeting Backups
Various wiper variants are specifically designed to prevent file restoration efforts by inflicting damage to backup processes and systems. Besides targeting files and the boot section, wiper malware also damages elements in the operating system that may assist in restoring damaged files.
Wiper malware generally actively searches for backups on the machine — including volume shadow copies — to carry out damage. It also destroys the Windows Recovery Console by utilizing system command-line utilities. The main idea behind focusing on backups is to ensure that victims can never recover any of the destroyed data.
Recent Wiper Examples
- WhisperGate — A wiper-like worm that targeted several industries in Ukraine, comprising government, non-profit, and IT organizations.
- HermeticWiper — A data-wiping malware that impacted machines and Ukrainian networks. One of its most damaging procedures is the ability to rewrite fragments on the disc to render recovery impossible.
- IsaacWiper — Overwrites all physical data and logical volumes found on a victim's machine. Used against a Ukrainian government network after Russia invaded Ukraine.
- CaddyWiper — The fourth wiper found attacking Ukrainian targets. CaddyWiper avoids damaging data on domain controllers, meaning attackers wish to keep their access inside the organizations.
- AcidRain — A wiper that hits routers and modems. Deployed to target the KA-SAT satellite broadband service to cripple SATCOM modems across Europe.
Mitigation Strategies
As far as wiper malware is concerned, victims not only encounter data and financial loss but also face the consequences of a damaged business reputation. Organizations can deploy multiple best practices to mitigate the impact:
- Maintain frequent, tested backups with a well-defined recoverability procedure — stored offline and air-gapped
- Segment networks logically to minimize the diffusion and spread of an attack
- Define and rehearse your incident communication plan before an attack occurs
- Deploy endpoint detection and response (EDR) solutions to stop attacks before they cause damage
- Monitor for Indicators of Compromise (IoCs) specific to wiper malware variants
- Restrict administrative privileges and use the principle of least privilege
- Ensure backup systems are isolated from the main network to prevent wipers from reaching them