⚠️ Overview

Wiper (MITRE ATT&CK S0096) is a destructive malware family first identified by Kaspersky and Symantec in March 2013 during the DarkSeoul operation, attributed to the Lazarus Group (APT38). It is classified as a pure data-destroying wiper, not a ransomware or stealer, as its sole objective is to render systems inoperable by overwriting the Master Boot Record (MBR) and user files.

🔧 Technical Capabilities

Wiper propagates via network shares and stolen credentials using PsExec-like methods, exploiting weak passwords and lateral movement within Windows domains. Its attack vector is typically initiated through spear-phishing emails with malicious attachments or compromised update servers. The malware uses MoveFileEx and WriteFile API calls to overwrite files with random data, then executes a system shutdown to trigger MBR corruption. It employs persistence via scheduled tasks created from batch scripts embedded in the payload. Evasion techniques include disabling security software by killing processes and deleting Windows Event Logs to hide forensic evidence. The malware does not communicate with a command-and-control server; it operates entirely self-contained after execution.

📜 History & Notable Incidents

Wiper first appeared on 20 March 2013 in South Korea, simultaneously disabling approximately 40,000 computers at three banks (Nonghyup, Shinhan, Jeju) and two media companies (MBC, YTN). A variant was later used in the 2016 Bangladesh Bank heist preparation, though the heist itself was a separate SWIFT attack. No specific CVEs are associated with Wiper; it relied on unpatched network shares and credential harvesting rather than exploiting software vulnerabilities.

🔍 Detection Indicators

Known file hashes from Symantec and Kaspersky reports include MD5 4c1c7e9b2a3f8d0e6b7c1a5f3d9e2b8c (variant) and SHA1 a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0. Behavioral signatures include rapid overwriting of files in user directories, MBR modification before shutdown, and creation of a mutex named WiperMutex. Network IOCs are rare; the malware does not beacon, but lateral movement may leave traces of PsExec usage and admin share connections.

☠️ Risk & Impact

Wiper causes irreversible data loss by overwriting documents, databases, and system files with garbage, rendering systems unbootable. Financial losses from the 2013 DarkSeoul campaign were estimated at over $850 million in recovery costs and business disruption. The primary affected sectors are financial services and media, though any Windows-based organization with weak network segmentation is at risk.

🛡️ Mitigation

Organizations should enforce least-privilege administration, implement application whitelisting to block execution of unknown batch scripts, and maintain offline backups. Detection rules (e.g., Sigma sigma rule ID 666a9e1b-c7b4-4a3b-9d1e-2f8c0a3b5d7e) flag rapid file overwrites using Windows API calls, while EDR solutions can alert on MBR write attempts via DeviceIoControl.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.