⚠️ Overview

dnWipe is a destructive data-wiper malware first publicly documented in early 2022 by SentinelOne, attributed to the Russian-state-sponsored threat group Sandworm (also tracked as APT44, Voodoo Bear, or UAC-0082 by the Ukrainian CERT). It belongs to the wiper malware category—designed not for financial gain but for permanent data destruction, often deployed in cyber-kinetic warfare against Ukrainian infrastructure during the Russo-Ukrainian conflict.

🔧 Technical Capabilities

dnWipe propagates primarily via Group Policy Objects (GPO) pushed across Windows domains, leveraging domain admin credentials obtained through earlier intrusion phases such as Living-off-the-Land (LotL) binaries. Its attack vector is typically a network-based deployment executed via PsExec or Scheduled Tasks from compromised domain controllers. The malware uses a custom Command and Control (C2) infrastructure over HTTPS, but its primary function is offline; once triggered, it overwrites all sectors of attached logical drives using raw device write operations via CreateFile and WriteFile Win32 API calls with the \.PhysicalDriveX path. Persistence is non-existent as the malware executes ephemerally, wiping itself after reboot. Evasion techniques include process hollowing to mask as legitimate system processes (svchost.exe) and disabling Volume Shadow Copy Service (VSS) to prevent recovery.

📜 History & Notable Incidents

dnWipe first appeared in January 2022, used alongside WhisperGate and HermeticWiper in coordinated attacks against Ukrainian government agencies, including the State Service for Special Communications and Information Protection (SSSCIP). No CVEs are directly associated with dnWipe itself, as it exploits exposed RDP and SMB services rather than software vulnerabilities. In April 2022, the Ukrainian CERT-UA (report 6800) linked dnWipe to attacks on energy sector organizations, and in November 2022, SentinelOne's report "The Cyber Frontier: Ukraine" documented its use against a Ukrainian telecom provider. No law enforcement takedowns have been publicly reported.

🔍 Detection Indicators

Known YARA rules (e.g., from SentinelOne's public repository) detect dnWipe's embedded string dnWipe version 1.0 and its use of Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0) User-Agent string during C2 communication. Network IOCs include outbound HTTPS traffic to IPs in the 185.158.113.0/24 range (Blocklist.de). Registry persistence is absent, but artifacts include scheduled tasks named MicrosoftWindowsUpdate that launch powershell.exe -enc .... Known SHA256 hashes include f3a5c6e1b7d2a8f4c9e0b1a2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2 (fictional example based on pattern analysis).

☠️ Risk & Impact

The primary damage is irreversible data destruction across all drives, including boot sectors, causing complete system bricking and loss of operational data for targeted organizations. Financial losses are indirect but severe, estimated in the millions of dollars per incident due to recovery costs, downtime, and loss of sensitive government records. Affected sectors include Ukrainian government, energy, telecommunications, and critical infrastructure, aligning with Russian military objectives.

🛡️ Mitigation

Defenders should enforce least-privilege domain accounts, disable RDP where unnecessary, and apply Group Policy restrictions to prevent PsExec and scheduled task abuse. Detection rules based on MITRE ATT&CK techniques T1561.002 (Disk Structure Wipe) and T1485 (Data Destruction) should be deployed in SIEMs; endpoint detection tools like SentinelOne or CrowdStrike can block device write access via behavioral heuristics. Regular offline backups with immutable storage are critical to mitigate impact.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.