A newly discovered wiper malware, PathWiper, was deployed in Ukraine in June 2025 via legitimate endpoint administration tools. It overwrote files, and the grueling recovery has involved full rebuilds.

Unlike earlier wipers that blindly iterated through drive numbers, PathWiper is precise, verifying valid volumes before corrupting them, according to the industry publication Security Affairs.

Wiper malware is a particularly destructive type of malicious software designed with one primary goal: to cause irreparable damage to an organization's information systems. Unlike ransomware, which typically encrypts data for a ransom, wiper malware aims to completely take systems offline by destroying data and making recovery impossible.

How wiper malware works

Wiper malware operates by running an application on your system, employing various methods to permanently erase data. Its mechanisms are relatively simple but highly effective:

• Data overwriting: One common method involves overwriting entire disks, or specific data blocks, with junk data. This process can be repeated multiple times to ensure that the data cannot be recovered. Unlike simply "deleting" a file (which merely flags the space as available for new data), overwriting ensures the original data is irrecoverable.

• Deleting partitions and MBR: Wiper malware can delete logical volumes or partitions on a disk. A critical target is the Master Boot Record (MBR), which controls the operating system's loading process. By overwriting or deleting the MBR, the malware prevents the system from booting, rendering the hardware unusable.

These methods ensure that systems cannot be recovered, leading to massive operational disruption and data loss.

Why wiper malware is so devastating

The intent behind wiper malware is pure damage. Its goal is not financial gain but to completely disrupt and take an organization's information system offline. This type of attack is often politically motivated, and its impact can be catastrophic, leading to hundreds of millions of dollars in financial damage.

The 2017 NotPetya attack, widely considered the most costly cyberattack in history, masqueraded as ransomware but was a wiper. Delivered through a compromised update mechanism in Ukrainian tax software, it overwrote the Master Boot Record (MBR). It caused global disruption for businesses like Maersk (losing access to ~49,000 laptops and 1,000+ applications, costing $200–300 million), FedEx/TNT Express (global delivery disruption, ~$400 million), and Mondelez International (plants shut down).

Who is a target for wiper malware?

Historically, wiper malware has frequently been deployed against government entities. Still, major businesses (enterprise situations) with widespread impacts are also affected by these devastating attacks, rather than small to medium-sized businesses (SMBs).

Devastating wiper malware attacks on businesses

Several high-profile incidents demonstrate the destructive power of wiper malware:

• Shamoon (2012, 2016–2018): This data-wiping malware targeted the energy sector, including Saudi Aramco (wiping ~30,000 computers, forcing email and Internet shutdowns) and RasGas in Qatar. It famously overwrote files and MBR with images of a burning U.S. flag or a photo of a drowned Syrian child, highlighting its political motivation. Recovery for Aramco involved buying tens of thousands of new hard drives.

• Olympic Destroyer (2018): Disguised as ransomware, this wiper was designed to disrupt the IT systems of the 2018 PyeongChang Winter Olympics. It affected Atos, the global IT firm managing Olympic operations, knocking out ticketing, internet, Wi-Fi, and broadcaster systems for hours.

• AcidRain (2022): This wiper targeted routers and modems, leading to a massive supply-chain disruption. Victims included Viasat KA-SAT network modems in Europe and wind farms in Germany, bricking devices and requiring full replacement.

• HermeticWiper (2022): Used during the early stages of Russia’s invasion of Ukraine, it targeted banks, energy, and IT companies, rendering systems unbootable with NotPetya-like MBR overwrite logic. It is linked to Russia’s Sandworm group.

• CaddyWiper and  WhisperGate (2022): These advanced MBR and file-wiping malware variants were used in tandem with HermeticWiper to expand attacks against businesses in logistics, finance, and IT.

Common characteristics of business-focused wiper attacks

These devastating attacks often share common features that make them particularly effective:

• MBR Overwrite: Prevents systems from booting, making recovery difficult if not impossible.

• Network-aware: Enables lateral spreading across a network to destroy multiple endpoints simultaneously.

• Masquerades as ransomware: Often initially appears to be ransomware, which can hinder proper response and recovery efforts.

• Supply-chain vector: Exploits trusted software or vendor updates to gain access and deploy the wiper.

Protecting against wiper malware

For businesses, understanding these threats is crucial. Defending against them is essential.

Because wiper malware’s core function is to execute destructive file operations—typically by running unauthorized scripts or binaries that overwrite, delete, or corrupt files irreversibly—a Zero Trust solution is needed.  

ThreatLocker Application Allowlisting prevents wiper malware’s activities by stopping unknown or unauthorized binaries from running at all. Since wipers often come as payloads embedded in email attachments, remote exploits, or unauthorized scripts, blocking their execution outright is the most effective first line of defense.

Still, wiper malware may attempt to leverage legitimate apps to carry out destructive operations. Ringfencing adds containment controls that limit what trusted applications can do—such as accessing files or the network—thus reducing the blast radius if an allowed app is hijacked.

Request a free 30-day trial today and see how ThreatLocker takes your organization's security to the next level.

‍