ZeroWipe

ZeroWipe is a destructive Windows wiper malware associated with attacks attributed to the Russia-linked Sandworm APT, also tracked as UAC-0082. It was listed by ESET among the multiple wipers Sandworm used in 2022 attacks aimed at Ukraine. CERT-UA reported ZeroWipe as one of five destructive malware or script samples identified in the January 2023 attack against Ukraine’s national news agency Ukrinform. In that incident, the malware was intended to disrupt integrity and availability by overwriting files or disks with zero bytes or arbitrary data and then deleting them. CERT-UA stated attackers attempted, unsuccessfully, to disrupt user computers using CaddyWiper and ZeroWipe, while also using SDelete, AwfulShred, and BidSwipe across Windows, Linux, and FreeBSD environments. The attack involved attempted centralized deployment via a Group Policy Object that created scheduled tasks, and CERT-UA assessed the operation as attributable to UAC-0082 (Sandworm), associated with Russia’s GRU. A reported ZeroWipe sample was named upd.exe with MD5 54e5773071b193e109cbacc82565c6a9 and SHA-256 e3bc3689f01fd431cd2ed368ae91eceaa7c465c2781fa7b7dc2ec9143a404f79. The available content does not provide further technical details on ZeroWipe’s internal implementation beyond its destructive wiping behavior and Windows targeting.