Newly identified wiper malware “PathWiper” targets critical infrastructure in Ukraine

Cisco Talos reports a destructive attack against a Ukrainian critical infrastructure organization using a previously unidentified wiper called "PathWiper." The actor deployed the wiper via a legitimate endpoint administration console using a VBScript dropper (uacinstall.vbs) that wrote and executed sha256sum.exe; PathWiper programmatically enumerates and corrupts connected drives, NTFS artifacts (MBR, $MFT, $LogFile, etc.), and network shares. Talos attributes the operation to a Russia-nexus APT with high confidence, provides an IOC (SHA256), and recommends detection and prevention measures across endpoint, email, firewall, and network analytics products.