A Closer Look At Wiper Malware

CyberSense is a monthly bulletin by CSA that spotlights salient cybersecurity topics, trends and technologies, based on curated articles and commentaries. CSA provides periodic updates to these bulletins when there are new developments.

OVERVIEW

Wiper malware is a relatively new but highly destructive class of malicious software, first observed to have been used in the Middle East in 2012. During the Russia-Ukraine conflict in 2022, wiper malware emerged as a popular cyber weapon of choice for threat actors.

In this edition of CyberSense, we will dive deeper into the class of wiper malware, explore the recent rise in observations of cyber-attacks involving new wiper malware strains, and discuss how organisations can better defend themselves against these attacks.

Figure 1. A graphical illustration of data-erasing wiper malware

WHAT IS WIPER MALWARE?

At first glance, wiper malware share some similarities with its equally - or more infamous - sibling, ransomware. Both types of malware involve making files and data inaccessible to the victim. Some wiper malware variants may also deliberately masquerade as ransomware by demanding “ransom” fees from its victims.

However, unlike ransomware - which encrypts its victim’s data, temporarily denying access until the ransom is paid - wiper malware typically aims for destruction or to cause permanent loss.

The use of wiper malware is therefore usually not financially motivated – experts believe that wiper malware is mainly used by threat actors to cover their tracks after exfiltrating information from a network, or to cause outright disruption.

HOW DOES IT WORK?

Broadly, there are two mechanisms that wiper malware employ:

1. Overwriting system components, such as the Master Boot Record^[1] (MBR) or the Master File Table^[2] (MFT). This cripples the operability of the victim’s computer and prevents information from being accessed, although file contents remain untouched and may still be recoverable.
2. Overwriting or encrypting files, along with any backups found on the computer, to permanently delete the victim’s data and information. 

Threat actors today typically incorporate a mix between the two approaches to achieve the greatest damage in the shortest amount of time possible.

Wiper malware ranks among one of the most destructive classes of malicious software that hackers may employ. Such attacks on an organisation’s Information Technology (IT) systems could disrupt IT-dependent business operations extensively, and lead to losses of valuable data and information. Attacks on Operational Technology (OT) systems - such as those underpinning transportation systems or energy grids - could cause even greater damage by disrupting industrial systems and equipment, resulting in devastating effects and endangering lives.

One of the first wiper malware attacks observed was Shamoon, which emerged in 2012 when it was used in a disruptive attack against Saudi Arabia’s state-owned national oil company Saudi Aramco. Public reports suggest that Shamoon had been unleashed by a company insider with privileged access to Aramco’s network. Once a machine had been infected, Shamoon would erase the data on its hard drives and replace them with an image of a burning American flag. The malware infected over 30,000 computers, which were rendered useless and had to be replaced. Aramco was forced to shut down its internal corporate network to stop the virus from spreading. Researchers speculate that Shamoon could have been a copycat inspired by a similar malware Wiper that hit some Iranian networks earlier that year.

Some types of wiper malware are designed with the ability to autonomously propagate – or ‘worm’ –  throughout a compromised network by spreading copies of itself from computer to computer without any human interaction. These variants are particularly dangerous, as they are extremely difficult to contain once they have been let loose, and can result in wide-reaching rippling effects worldwide.

An example of the destructive potential of self-propagating wiper malware can be seen in NotPetya. In 2017, researchers started to notice this self-propagating wiper malware infiltrating the networks of Ukrainian organisations. NotPetya had masqueraded as ransomware by demanding “ransom” fees from users, but in reality lacked a ransom recovery mechanism. With its ability to worm across different systems via a vulnerability in the Windows system, NotPetya quickly spread beyond its original targets, eventually crippling some of the largest corporations worldwide, including international shipping giants Maersk and FedEx, pharmaceutical company Merck and construction company Saint Gobain. According to estimates from the White House, the total damages from NotPetya in 2017 reached US$10 billion, making it the most financially damaging cyber-attack to date.