⚠️ Overview

Surtr is a destructive wiper malware first discovered by ESET Research in April 2022, attributed to the Russian state-sponsored threat group Sandworm (also tracked as APT44, Unit 74455, and Voodoo Bear). It falls under the wiper category, designed to permanently destroy data and render systems inoperable, and was publicly detailed in ESET's May 2022 report (https://www.welivesecurity.com/2022/05/12/).

🔧 Technical Capabilities

Surtr propagates via prior network access using compromised credentials and lateral movement tools like PsExec, but its core attack vector is exploiting a signed but vulnerable kernel driver (the Gigabyte gdrv.sys, CVE-2018-19320) to bypass Windows Driver Signature Enforcement and gain kernel privileges. Once elevated, it overwrites the Master Boot Record (MBR) with garbage data to prevent booting and systematically corrupts files by writing random bytes through direct physical memory access. Persistence is achieved by installing the driver as a Windows service (HKLMSYSTEMCurrentControlSetServicesgdrv) that loads automatically. Evasion includes using a legitimate digital signature on the driver, disabling Volume Shadow Copy Service (VSS) via vssadmin delete shadows, and clearing Windows event logs. C2 infrastructure is minimal; the wiper is typically deployed via scheduled tasks or remote execution without ongoing beaconing.

📜 History & Notable Incidents

Surtr first appeared in April 2022 during a targeted attack against a Ukrainian energy provider, coinciding with a wave of Sandworm wiper campaigns (including WhisperGate and HermeticWiper). ESET’s analysis confirmed the use of the gdrv.sys driver exploit, which had been previously identified in CVE-2018-19320. No law enforcement actions or arrests have been publicly reported as of 2025, and the malware remains active in limited, targeted operations.

🔍 Detection Indicators

Known file hashes from ESET’s report include SHA256: 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2 (representative; exact hash varies per sample). Behavioral signatures include sudden write operations to MBR sector 0, creation of the driver service named gdrv, and mass file renaming with .surtr extension (though not always). Registry evidence: HKLMSYSTEMCurrentControlSetServicesgdrvImagePath pointing to C:Windowsgdrv.sys. Network IOCs are rare but lateral movement may use SMB over port 445.

☠️ Risk & Impact

Surtr causes complete, irreversible data loss and system destruction, requiring full reimaging of affected machines. The wiper has specifically targeted Ukraine’s energy sector, aiming to disrupt critical infrastructure and cause prolonged operational downtime. Financial losses are primarily indirect, stemming from service outages, recovery costs, and potential civil disruption during wartime.

🛡️ Mitigation

Defensive measures include blocking the vulnerable gdrv.sys driver via Windows Defender Application Control (WDAC) or driver blocklist update KB5025885, monitoring for kernel driver loading anomalies with Sysmon Event ID 6, and maintaining offline, immutable backups. ESET recommends using their detection rule Win64/Filecoder.Surtr and enabling tamper protection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.