HOMETHREATSHermeticWiper
APT / THREAT GROUP

HermeticWiper

6
aliases
Last seen:Mar 17, 2026

Intelligence Profile

According to SentinelLabs, HermeticWiper is a custom-written application with very few standard functions. It abuses a signed driver called "empntdrv.sys" which is associated with the legitimate Software "EaseUS Partition Master Software" to enumerate the MBR and all partitions of all Physical Drives connected to the victims Windows Device and overwrite the first 512 Bytes of every MBR and Partition it can find, rendering them useless.

This malware is associated to the malware attacks against Ukraine during Russians Invasion in February 2022.

Threat Analysis

HermeticWiper is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.malwarebytes.com/threat-intelligence/2022/03/hermeticwiper-a-detailed-analysis-of-the-destructive-malware-that-targeted-ukraine/
→https://blog.nviso.eu/2022/02/24/threat-update-ukraine-russia-tensions/
→https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware
→https://blogs.blackberry.com/en/2022/03/threat-thursday-hermeticwiper
→https://blogs.microsoft.com/on-the-issues/2022/12/03/preparing-russian-cyber-offensive-ukraine/

Quick Facts

TypeAPT / Threat Group
Aliases6

Also Known As

KillDisk.NCVNEARMISSwin.hermeticwiperHermeticWiperDriveSlayerFoxBlade

External Intelligence

Malpedia: win.hermeticwiper

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search HermeticWiper