# Wiper Malware Malware designed to **destroy data rather than steal or ransom it** — wiping or corrupting files, master boot records, or firmware so that systems are rendered inoperable and, ideally for the attacker, unrecoverable. Where most cybercrime is acquisitive (espionage, theft, extortion), a wiper is purely *destructive*: its goal is sabotage, disruption, and the imposition of cost. That economic logic — no payday, only damage — is why wipers are predominantly **state weapons** rather than criminal tools. ## The NotPetya canonical case The defining example is **NotPetya** (June 2017), attributed by the U.S., U.K., and allied governments to **Sandworm**, a unit of Russia's GRU military intelligence (see [[Russian State Hacking Groups]]). NotPetya is widely called the most destructive cyberattack in history, with White House damage estimates exceeding **$10 billion**. Its design is a case study in wiper deception and collateral damage: - **Disguised as ransomware, built to destroy.** It displayed a ransom note, but its encryption deliberately discarded the information needed for decryption — paying did nothing. The ransomware costume was misdirection, not a business model. - **Supply-chain delivery.** The initial vector was a poisoned update to *M.E.Doc*, a Ukrainian tax-accounting program — a [[Supply-Chain Attack]] used to seed the target country. - **Worming via stolen NSA tooling.** It spread automatically using **EternalBlue**, an exploit developed by the U.S. NSA and leaked by the Shadow Brokers — the same exploit that powered the WannaCry outbreak weeks earlier. - **Uncontainable blast radius.** Though aimed at Ukraine, it tore through global firms with Ukrainian operations — Maersk, Merck, WPP, Mondelez, FedEx's TNT — demonstrating that a "targeted" wiper cannot be reliably confined. ## The wider wiper family NotPetya sits in a lineage of state destructive operations: **Shamoon** (2012), an Iran-attributed wiper that crippled ~30,000 Saudi Aramco workstations; the Sandworm attacks on Ukraine's power grid (2015–16) and the **Olympic Destroyer** sabotage of the 2018 Winter Olympics; and the wave of wipers (**WhisperGate**, **HermeticWiper**, and the **AcidRain** strike on the Viasat satellite network) launched against Ukraine around Russia's 2022 full-scale invasion. The pattern is consistent: wipers accompany geopolitical conflict and are deployed for strategic disruption. ## Right-wing-KB relevance Wiper malware is the sharp end of state cyberwarfare and a recurring instrument of Russian operations this vault tracks. It illustrates two themes directly: the **spillover risk** of cyber weapons (NotPetya's global rampage shows there is no clean "surgical" cyberstrike), and the **proliferation hazard** of offensive tooling (a leaked NSA exploit became the engine of the costliest attack in history). It is the destructive counterpart to the espionage-oriented [[Supply-Chain Attack]] and the influence-oriented [[Hack-and-Leak Operation]] — same actors, different objective: not access, not persuasion, but ruin. ## Distinct from neighbors - **Ransomware** — encrypts to *extort*, with (usually) a real decryption path; a wiper only pretends to, or doesn't bother. NotPetya is the canonical wiper-in-ransomware-clothing. - **[[Supply-Chain Attack]]** — a *delivery method*; a wiper is a *payload* (NotPetya used both). - **Logic bomb** — destructive code triggered on a condition; a subtype of the destructive-malware family. - **DDoS** — denies service by flooding, but doesn't destroy data; a wiper damages the systems themselves. ## See Also - [[Cybersecurity Lexicon]] - [[Russian State Hacking Groups]] - [[Supply-Chain Attack]] - [[Hack-and-Leak Operation]] - [[Stuxnet and Cyber Warfare Origins]] - [[Information Warfare Hub]]