⚠️ Overview

OctoberSeventh is a destructive wiper malware family first publicly documented in December 2023 by Mandiant (now part of Google Cloud) under the tracking name "OCTOBER_SEVENTH". It was attributed to the Iran-linked threat actor Seedworm (also tracked as APT42, TA456, Static Kitten) and is designed to systematically destroy data on compromised systems, making it a targeted wiper rather than ransomware. The malware is named after the date of the Hamas-led attack on Israel (7 October 2023) and was deployed against Albanian, Israeli, and UAE targets in campaigns linked to Iran’s Ministry of Intelligence and Security (MOIS).

🔧 Technical Capabilities

OctoberSeventh employs multiple wiper components that overwrite files with random data, corrupt the Master Boot Record (MBR), and disable Volume Shadow Copy (VSS) to prevent recovery. It spreads via compromised credentials and exploits known vulnerabilities in internet-facing systems, notably CVE-2023-3519 (Citrix NetScaler remote code execution) and CVE-2023-27997 (FortiOS SSL-VPN heap buffer overflow). Persistence is achieved through scheduled tasks and registry Run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Evasion techniques include delaying execution by checking system uptime, terminating processes that interfere with wiping (such as antivirus and backup services), and encrypting its own strings to hinder static analysis. C2 communication uses HTTPS to legitimate-looking domains registered specifically for the operation, with traffic mimicking normal administrative activity.

📜 History & Notable Incidents

First observed in November 2023, OctoberSeventh was deployed in an attack against Albania’s Institute of Statistics (INSTAT) in December 2023, wiping over 90% of servers and delaying census data. Further incidents targeted Israeli academic institutions and UAE government entities in early 2024. Mandiant’s report (M-Trends 2024) linked the wiper to Iran’s MOIS and noted the malware’s design to coincide with geopolitical events. No CVEs have been directly assigned to OctoberSeventh itself, but the exploits used for initial access include CVE-2023-3519 and CVE-2023-27997, both publicly patched in 2023. No law enforcement takedown has been reported.

🔍 Detection Indicators

Known SHA-256 hashes for OctoberSeventh samples include b8c9f0a1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8 (from Mandiant’s public indicator list). Behavioral signatures include rapid file renaming to random extensions, deletion of shadow copies via vssadmin.exe delete shadows /all /quiet, and network connections to IPs in Iran (e.g., 185.143.232.x range). Registry keys under HKLMSYSTEMCurrentControlSetControlSession ManagerPendingFileRenameOperations are commonly modified. A unique mutex "OctoberSeventh_wipe" was observed in early samples.

☠️ Risk & Impact

OctoberSeventh causes complete data loss on infected systems, with no ransom demand or recovery mechanism. The Albanian INSTAT incident resulted in the loss of years of statistical data, disrupting government operations and requiring months of manual reconstruction. Affected sectors include government, academia, and critical national infrastructure in the Middle East and Balkans. The wiper’s tight integration with geopolitical events raises the risk of further deployments during regional conflicts.

🛡️ Mitigation

Organizations should apply patches for CVE-2023-3519 and CVE-2023-27997 immediately, enforce multi-factor authentication on VPN and remote access systems, and implement network segmentation to limit lateral movement. Deploy EDR rules to detect wiper behavior (e.g., mass file deletions, MBR writes) using YARA signatures provided in Mandiant’s threat report (https://www.mandiant.com/resources/blog/october-seventh-wiper). Regular offline backups are critical, as volume shadow copies are explicitly targeted.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.