MalwarePublished 5 Jun 2025

Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine

Source AlienVault OTX General

Description

A destructive attack on Ukrainian critical infrastructure using a new wiper malware called 'PathWiper' has been observed. The attack, attributed to a Russia-nexus APT group, utilized a legitimate endpoint administration framework to deploy the wiper across connected endpoints. PathWiper overwrites file system artifacts with random data, targeting physical drives, volumes, and network shared drives. Its capabilities are similar to HermeticWiper, previously used against Ukrainian entities. The malware's sophisticated approach to identifying and corrupting connected drives and volumes distinguishes it from earlier wipers. This attack underscores the ongoing threat to Ukrainian infrastructure despite the prolonged conflict with Russia.

Impact

For European organizations, especially those with operational or business ties to Ukraine or similar critical infrastructure sectors, PathWiper represents a significant threat. The malware’s deployment via legitimate endpoint administration frameworks suggests that any organization using similar tools and network architectures with shared drives and volumes could be at risk if targeted. Successful infection results in permanent data loss and system downtime, severely impacting confidentiality, integrity, and availability. Critical sectors such as energy, transportation, healthcare, and government services could face operational paralysis, financial losses, and reputational damage. The malware’s ability to propagate across connected endpoints and network shares increases the potential scope of impact within an organization. Given the geopolitical tensions and ongoing conflict, there is an elevated risk of spillover or targeted attacks against European entities supporting Ukrainian infrastructure or sharing similar technology stacks. The sophisticated deployment method complicates detection, increasing the risk of delayed response and mitigation, which could exacerbate operational disruptions.

Defensive guidance

1. Enforce strict access controls and network segmentation for endpoint administration frameworks to minimize their misuse and reduce the attack surface. 2. Continuously monitor and audit the use of legitimate administrative tools for anomalous activities, such as unusual deployment patterns or execution of destructive commands. 3. Implement robust backup strategies, including offline or immutable backups, to ensure data recovery in the event of a wiper attack. 4. Harden network shares and volumes by applying least privilege principles and monitoring for unauthorized access or modifications. 5. Deploy advanced endpoint detection and response (EDR) solutions capable of identifying suspicious file system activities indicative of wiper behavior, such as random data overwrites. 6. Conduct regular threat hunting exercises focused on PathWiper indicators of compromise, including the provided malware hash. 7. Develop and regularly update incident response plans specifically addressing destructive malware scenarios to enable rapid containment and recovery. 8. Collaborate with national cybersecurity agencies and information sharing organizations to stay informed about emerging threats and indicators related to PathWiper. 9. Restrict lateral movement by enforcing multi-factor authentication and maintaining credential hygiene to prevent credential theft and misuse. 10. Maintain up-to-date patching of all systems to reduce exposure to other vulnerabilities that could facilitate initial access, even though no specific patches exist for PathWiper.

Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine

Description

Impact

Defensive guidance

Indicators of compromise

Hashes 1

Community reviews

Description

AI analysisMachine-generated, updated 7 Jul 2025, 16:26 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

Hashes 1

Community reviews

Related threats