Discovering Wipers: The Silent Threat That Ruthlessly Destroys Data

Redazione RHC : 3 August 2025 10:56

Wider malware (in Italian “eliminator” or “deleter”) is a type of malicious software designed to destroy or “erase” data and files on the computer systems it infects. Unlike other types of malware such as viruses or Trojans, wipers do not seek to infect as many computers as possible or steal sensitive data; their primary goal is data destruction.

Widers can act in various ways: for example, they can overwrite data on hard drives or storage devices, preventing access to the original files; they can delete system files or critical parts of the operating system, rendering the system unusable; They can completely erase the data on your hard drive, leaving your computer completely empty.

Wider attacks are often associated with high-profile cyber attacks, such as those targeting businesses or government organizations. However, wipers can also target individual users and small businesses, causing considerable damage.

The Origins of Wipers

Overall, wipers appear to have originated as a type of malware used by governments or terrorist groups to destroy sensitive data or create havoc. However, in recent years, their use has also expanded to cyber attacks conducted by criminals with a profit-making agenda.

In recent years, there have also been several wiper attacks conducted by cybercriminal groups with the aim of extorting money from victims. In these cases, wipers are used as a threat tool to force victims to pay a ransom to restore their data.

In any case, wipers are considered one of the most destructive and dangerous types of malware, capable of causing extensive and irreparable damage to computer systems.

The first wiper in history is not known with certainty, as the term “wiper” was coined relatively recently to describe a specific strain of malware that erases or destroys data. However, there have been several cases of malware destroying data on infected systems since the 1980s and 1990s.

Since then, the number and sophistication of wipers have grown exponentially, and today they represent one of the most fearsome threats to cybersecurity.

The most famous wipers

In recent history, several destructive wipers have emerged, but they have always been used for cyberwarfare purposes or to attack government organizations. The most well-known are:

• Shamoon: This malware was first used in 2012 in an attack against the Saudi Arabian oil company Aramco, resulting in the deletion of over 30,000 computers. The malware subsequently targeted other Saudi Arabian and Middle Eastern companies. The official attribution to Shamoon has been disputed, but it has been reported that the malware may have been developed by Iranian state-sponsored groups.
• ZeroCleare: This malware was used in a 2019 attack against the Saudi energy sector. The malware attempted to erase data on the hard drives of infected computers, but the attack was foiled before it could cause significant damage. Official attribution has not been released, but it has been reported that the malware may have been created by Iranian state-sponsored groups.
• NotPetya: A wiper malware discovered in 2017 that caused significant damage globally. NotPetya spread primarily through a vulnerability in Ukrainian accounting software, but also affected many other companies worldwide. The wiper overwrote files on infected computers, rendering them completely unusable. Although payment is futile, NotPetya still poses as ransomware, warning the user of the incident and demanding a ransom in bitcoin to get their files back. Given the impossibility of data recovery and its extreme destructiveness, it is no longer identified as ransomware but as a wiper.
• Isaac Wiper: is a wiper of presumably Russian origin that surgically erases data from government networks and devices, planned to be deployed in the war against Ukraine.

The wiper attack on Sony Pictures

On November 24, 2014, a hacker group called Lazarus Group (also known as Guardians of Peace or Whois Team) leaked confidential data from the film studio Sony Pictures Entertainment (SPE). The data included personal information about Sony Pictures employees and their families, employee emails, salary information for company executives, copies of then-unreleased Sony films, plans for future Sony films, scripts for certain films, and other information.

During the hack, the group demanded that Sony withdraw its upcoming film The Interview, a comedy about a plot to assassinate North Korean leader Kim Jong-un, and threatened terrorist attacks on theaters showing the film.

After many major US theater chains decided not to screen The Interview in response to these threats, Sony chose to cancel the film’s formal premiere and mainstream release, opting to move directly to a digital release.

US intelligence officials, after evaluating the malware used (a variant of the Shamoon wiper malware), the techniques and network sources used in the hack, concluded that the attack was sponsored by the North Korean government, which denied any responsibility.

The perpetrators used the wiper to wipe Sony’s IT infrastructure.

How to Defend Yourself from Wipers

To defend yourself from wipers, you need to follow many common-sense rules that are often found in all good cybersecurity practices.

Measures you can take to protect yourself from wipers include:

1. Regular data backups: The most effective way to protect yourself from wipers is to regularly back up your data to external storage devices or the cloud. In the event of a wiper attack, you can restore your data from the backup copy.
2. Installing security software: Installing security software, such as antivirus and firewall software, can help prevent malware infection and detect attacks.
3. Updating software: Keeping your software up to date is important to fix known vulnerabilities that could be exploited by wipers.
4. Using strong passwords: Using complex passwords to access your devices and online accounts can help prevent unauthorized access by criminals. IT.
5. User training: Training users on cybersecurity best practices, such as identifying phishing emails and using social media wisely, can help prevent malware infection.
6. Isolate systems: Isolating critical systems, such as those used in industrial environments, from the rest of the network can limit the potential damage caused by a malware attack.
7. Constant monitoring: Constantly monitoring the network and systems for suspicious activity can help identify and mitigate attacks before they cause damage. irreparable.

Taking these measures can help prevent wiper infection and limit the potential damage caused by a malware attack.

Redazione
The editorial team of Red Hot Cyber consists of a group of individuals and anonymous sources who actively collaborate to provide early information and news on cybersecurity and computing in general.

Lista degli articoli