Skip to main content
Mallory
MalwareUsed by 2 actors

AWFULSHRED

AwfulShred is a destructive Linux wiper, described as an obfuscated malicious Linux shell script designed to corrupt or wipe targeted Linux systems. It uses the shred command to overwrite files and increase data destruction, and reported behaviors include disabling or corrupting Apache, HTTP, and SSH services, deactivating swap files, clearing bash history, killing processes, stopping services, enabling SysRq functions, and rebooting the system. The malware is associated with data-destruction activity on Linux, and reporting also places it alongside non-Windows destructive malware affecting Solaris systems in broader Sandworm operations. High-confidence reporting links AwfulShred to Sandworm/UAC-0082, a Russia-linked GRU-associated threat actor, including its use in the April 2022 attack against a Ukrainian energy company alongside Industroyer2, CaddyWiper, Orcshred, and Soloshred, where the wipers were intended to hinder recovery, and in the January 2023 attack against Ukraine’s national news agency Ukrinform, where CERT-UA identified a Linux AwfulShred script named r.sh. The content explicitly states that in 2022 Sandworm used AwfulShred in attacks aimed at Ukraine. Mentioned artifact details for the Ukrinform case include r.sh (AwfulShred) with MD5 3a1070b882d6843fcfa9490c24700bd1 and SHA-256 246607235d560e90590dcf1b0507ab18de74afcc4429d8d5f3ba97eacc92d73f.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Sandworm

Among the tools that Sandworm deployed on the energy company's network was a Windows disk wiper called CaddyWiper and similar disk-wiping tools dubbed Orcshred, Soloshred, and Awfulshred for Linux and Solaris systems.

via dark readingdarkreading.com
UAC-0082

"...AwfulShred (Linux)..."; file reference: "r.sh (AwfulShred)"

via cert uacert.gov.ua
MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique
T1059.004Unix ShellEvidence2
TacticExecution

"/root/r.sh (AwfulShred)" and "/sbin/audit.sh (BidSwipe)"

Stealth

1 technique
T1070.004File DeletionEvidence1
TacticStealth

deactivate swap files, clear bash history and finally reboot the system

Impact

3 techniques
T1485Data DestructionEvidence3
TacticImpact

Among the tools that Sandworm deployed on the energy company's network was a Windows disk wiper called CaddyWiper and similar disk-wiping tools dubbed Orcshred, Soloshred, and Awfulshred for Linux and Solaris systems.

T1489Service StopEvidence1
TacticImpact

This obfuscated malicious script can also disable and corrupts apache, HTTP and SSH services

T1529System Shutdown/RebootEvidence1
TacticImpact

finally reboot the system

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.