Loading story…
Researchers reported that systems hit by HermeticWiper were also presented with a fake ransomware operation dubbed GoRansom, but the ransom component appeared to be a distraction rather than a genuine extortion campaign. The attack combined destructive wiping activity with a ransom note, creating the appearance of financially motivated malware while the underlying objective was irreversible system damage.
Analysis linked the incident to the broader HermeticWiper intrusion set, indicating that the so-called GoRansom element lacked the hallmarks of a normal ransomware deployment and instead served as cover for sabotage. The operation highlighted how threat actors can blend wiper malware with counterfeit ransom messaging to delay attribution, confuse responders, and mask a destructive attack as ordinary cybercrime.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published analysis describing the HermeticWiper attack and associated Elections GoRansom activity, characterizing the ransomware component as a smoke screen for the wiper operation. No earlier specific event dates are provided in the reference metadata, so the publication date is used as the event date.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed a destructive Go-based Windows backdoor dubbed **GigaWiper** that has been observed in compromised environments since October 2025, combining espionage, remote access, and sabotage functions in a single modular implant. The malware supports about 20 command codes and can wipe physical disks, overwrite the Windows drive, trigger BSOD-based disruption, clear event logs, manipulate processes, services, and the registry, capture screenshots, record screens, and provide hidden VNC-like remote control. It also masquerades as OneDrive and uses **RabbitMQ**, **Redis**, and in some reporting **MinIO** for command, result handling, and data exfiltration. Microsoft said GigaWiper appears to be assembled from at least three malware families, with code overlaps linking it to **Crucio** and **FlockWiper** and references to a broader framework labeled **GRAT**. One destructive component mimics ransomware by encrypting files without preserving a recovery key, making restoration impossible except from clean backups, while another performs multi-pass secure wiping. Separate reporting said the same hashes and command-and-control infrastructure matched Binary Defense's earlier **BLUERABBIT** findings, and cited broader research associating related tooling with likely Iran-linked operations targeting Israeli organizations, though Microsoft did not publicly attribute the activity to a country.
Jul 10, 2026
Rapid7 assessed with moderate confidence that an intrusion initially presented as a **Chaos ransomware** incident was in fact a false-flag operation by the Iranian MOIS-linked group **MuddyWater** (also tracked as Seedworm). The attackers reportedly used **Microsoft Teams** social engineering, screen sharing, credential theft, and **MFA** manipulation to gain access, then deployed legitimate remote administration tools including **AnyDesk** and **DWAgent** to maintain persistence and move deeper into the environment, including toward a domain controller. Researchers said the operation diverged from a typical ransomware playbook because it emphasized long-term access, internal footholds, and data theft over disruptive encryption for profit. Rapid7 linked the activity to MuddyWater through overlapping infrastructure such as `moonzonet[.]com`, tradecraft consistent with prior operations, and use of the revoked **"Donald Gay"** code-signing certificate previously tied to MuddyWater malware including Stagecomp and Darkcomp. The intrusion also used a loader, `ms_upd.exe`, to deploy a custom backdoor, `Game.exe`, which masqueraded as a Microsoft WebView2 sample application and enabled command execution, file operations, and persistent shell access. Researchers concluded that the ransomware branding and extortion behavior were likely intended to delay attribution and mask espionage or prepositioning objectives, continuing a pattern in which MuddyWater uses criminal ransomware themes as operational cover.
Jun 29, 2026
Trellix disclosed **PathWiper**, a destructive malware operation that abuses **DCOM** to move across Windows environments and trigger large-scale disk wiping. The activity was presented as a network erasure campaign rather than conventional ransomware, with the malware designed to render systems inoperable by corrupting or destroying data across affected hosts. The report highlights the use of legitimate Windows remote management mechanisms to propagate the wiper, underscoring how trusted administrative features can be turned into destructive tradecraft. For defenders, the findings point to the need for tighter controls on **DCOM** usage, stronger monitoring of lateral movement through native Windows components, and rapid containment of suspicious remote execution activity before wiping actions spread across the network.
Jul 10, 2026