HermeticWiper & resurgence of targeted attacks on Ukraine

ThreatLabz provides a technical analysis of HermeticWiper and two related targeted spearphishing campaigns against Ukrainian entities (Nov 2020–Feb 2022). The report details delivery chains (malicious documents, macros, VBScript, LNK→MSI→NSIS), destructive wiper behavior (kernel driver usage to overwrite MBR and MFT, disable VSS and crash dumps), embedded signed drivers, C2/infrastructure overlap with Gamaredon, and extensive IOCs (hashes, domains, IPs) for detection and mitigation.