a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92

WhisperGate stage1.exe - MBR-corrupting destructive payload disguised as ransomware, deployed against Ukrainian organisations from 13 January 2022. Hash from Microsoft MSTIC, republished in CISA / FBI AA22-057A Table 1. Microsoft renamed the responsible actor Cadet Blizzard (DEV-0586) in June 2023 and attributed it to a GRU subgroup.

family

WhisperGate

first seen

Jan 12, 2022

publisher

CISA