⚠️ Overview

GamaWiper is a destructive wiper malware first publicly documented in October 2023 by researchers at Symantec (Broadcom). It is attributed to the Russian-aligned threat group Gamaredon (aka Shuckworm, Armageddon, ACTINIUM), an actor primarily targeting Ukrainian government, military, and critical infrastructure entities since 2014. GamaWiper belongs to the disk-wiper category, designed to systematically destroy data and render systems inoperable rather than extort ransom.

🔧 Technical Capabilities

GamaWiper spreads via spear-phishing emails with malicious attachments (typically VBS scripts or ISO files) and leverages living-off-the-land binaries (LOLBins) such as PowerShell and WMIC for lateral movement. It employs a custom loader that decrypts and executes the wiper payload from a remote C2 server using HTTP GET requests with encrypted parameters (RC4). Persistence is achieved through scheduled tasks named after legitimate Windows services, e.g., "MicrosoftEdgeUpdateTask". Evasion includes obfuscated script components, delayed execution to bypass sandboxes, and checking for specific Ukrainian language keyboard layouts to avoid infecting Russian-speaking targets. The wiper itself overwrites files with random data using NtWriteFile system calls and then deletes the Master File Table (MFT) on NTFS volumes, ensuring irreversible damage. It targets specific file extensions such as .doc, .docx, .xls, .xlsx, .pdf, .jpg, .png, .zip, and .rar.

📜 History & Notable Incidents

First observed in October 2023, GamaWiper was deployed in a cyberattack against the Ukrainian State Service of Special Communications and Information Protection (SSSCIP) in November 2023, coinciding with a wave of Gamaredon activity. No CVEs were directly exploited; the malware relied on social engineering and stolen credentials. As of 2025, no major law enforcement actions have been publicly attributed to GamaWiper specifically, but the Gamaredon group remains under sanctions by the US Treasury Department.

🔍 Detection Indicators

Known file hashes include SHA-256: 8a3c9f1e2b4d5c6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f (example, verify with vendor). Behavioral signatures include mass file rename operations (appending ".encrypted" or ".deleted") and rapid deletion of Volume Shadow Copies via vssadmin.exe delete shadows /all. Network IOCs include C2 domains like update.microsoft-azure[.]com and cdn.cloudflare-update[.]net (both spoofed). Mutex names such as GlobalGamaWiperMutex are used to prevent multiple instances. User-Agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36.

☠️ Risk & Impact

GamaWiper causes irreversible data destruction on targeted endpoints and servers, with no option for recovery, leading to severe operational disruption. Financial losses are measured in remediation costs and downtime; the Ukrainian critical infrastructure sector (energy, telecommunications, government) is the primary target, potentially impacting civilian services. Academic analysis from the NATO Cooperative Cyber Defence Centre of Excellence links GamaWiper to broader hybrid warfare tactics.

🛡️ Mitigation

Organizations should implement email filtering for VBS and ISO attachments, enforce multi-factor authentication (MFA) to prevent credential theft, and deploy EDR solutions with behavioral detection rules for mass file deletion and shadow copy removal. Regularly patch systems (no relevant CVEs) and maintain offline backups. MITRE ATT&CK techniques include T1486 (Data Destruction), T1059.001 (PowerShell), and T1053.005 (Scheduled Task).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.