threatintel
actor tracker
IOC pivot
ioc · sha-256

1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591

RU · RussiaSandwormconfidence · high

HermeticWiper / Trojan.Killdisk sample (Symantec Threat Hunter Team), deployed against Ukrainian organisations from 23 February 2022. Listed in CISA / FBI joint advisory AA22-057A appendix Table 2. The campaign is widely attributed to GRU Unit 74455 (Sandworm).

family
HermeticWiper
first seen
Feb 22, 2022
publisher
CISA
source citation