Malware Family Tracking: Russian Cyberweapons Deployed Against Ukraine

The Russo-Ukrainian cyber conflict has witnessed the most prolific deployment of state-developed destructive malware in history. Russian threat actors, particularly the Sandworm group (GRU Unit 74455), have deployed a succession of custom malware families against Ukrainian targets—destructive wipers that erase data, specialized OT attack tools designed to cause physical infrastructure damage, and implants enabling persistent espionage. Tracking these malware families—their technical capabilities, code relationships, deployment patterns, and evolution over time—provides intelligence that drives both defensive detection and attribution assessments. The body of knowledge accumulated through this tracking represents the global security community's most comprehensive real-world study of nation-state cyberweapon development and deployment.

Key Russian Malware Families Deployed Against Ukraine

Sandworm's Wiper Campaign Patterns

The deployment of destructive wiper malware—software designed to overwrite file system structures and master boot records to render systems unbootable—has been a consistent element of Russian offensive cyber operations against Ukraine. WhisperGate, deployed in January 2022 in the lead-up to the full-scale invasion, mimicked ransomware but lacked a functional decryption mechanism—its purpose was destruction, not criminal extortion. HermeticWiper, deployed on 24 February 2022 (the invasion's first day), was a more sophisticated wiper that abused legitimate partition management drivers to corrupt disk structures. CaddyWiper followed in March 2022, providing additional destructive capability. The pattern—multiple wiper families deployed in sequence using different technical approaches—suggests stockpiled capabilities intended to overwhelm defenders who might develop detection and blocking for any single variant.

Industroyer2: Evolution of OT Cyberweapons

Industroyer2, discovered by CERT-UA and ESET in April 2022, demonstrated that Sandworm had continued developing OT-specific attack capabilities in the years since the original 2016 Industroyer attack. The upgraded malware was specifically compiled targeting a single Ukrainian energy company's substation equipment—detailed ICS targeting parameters were hardcoded including device IP addresses and configuration data that indicated significant pre-attack reconnaissance. Industroyer2 was found on systems alongside CaddyWiper, with the wiper configured to activate after the OT attack—suggesting a multi-stage plan to cause a power outage while simultaneously impeding incident response by destroying systems used for manual control recovery. CERT-UA and ESET's public disclosure of the attack (and the detection that prevented execution) provided the global energy sector with detailed technical intelligence on this advanced capability.

Code Reuse and Family Relationships

Analysis of the Russian malware arsenal against Ukraine has identified code reuse and structural similarities that help analysts attribute new samples and understand development lineage. Sandworm's wiper development shows iterative refinement: later wipers incorporated lessons from earlier deployments, adding redundant wiping mechanisms (targeting both MFT/boot sectors and individual files) and obfuscation to evade detection by signatures targeting earlier variants. The reuse of specific driver abuse techniques—exploiting legitimate partition management or disk access drivers to perform destructive operations that bypass security software watching for direct disk writes—appears across multiple families. Tracking these code-level relationships through binary diff tools and function hash comparisons allows analysts to definitively link new samples to previously attributed campaigns, supporting attribution even when infrastructure indicators have changed.

Malware Tracking and Detection Infrastructure

Systematic tracking of Russian malware families targeting Ukraine involves multiple components: CERT-UA's national sample collection and analysis; commercial threat intelligence platforms (Recorded Future, Intel 471, Mandiant Advantage) that aggregate malware intelligence from global telemetry; the VirusTotal ecosystem where samples are submitted and analyzed by the security community; the OpenMalware and Malware Bazaar repositories for sample sharing; and MISP installations where indicators from analyzed samples are structured for machine sharing. Tracking across this ecosystem allows the global community to detect new variants of known families rapidly—when a new wiper appears with code similarities to CaddyWiper, analysts can quickly assess relationships and develop detection before a new campaign achieves widespread impact. Ukraine's transparent sharing culture (publishing detailed CERT-UA reports openly, rather than treating threat intelligence as proprietary) has made this global tracking ecosystem far more effective than it would be if Ukrainian defenders held their intelligence privately.

FAQ

What is a wiper malware?

Wiper malware is designed to permanently destroy data on infected systems, typically by overwriting file system structures, master boot records, or individual files in ways that prevent recovery. Unlike ransomware that encrypts data for ransom, wipers have purely destructive purposes, intended to cause operational disruption rather than generate revenue.

Who is Sandworm?

Sandworm is the name applied by the security research community to a Russian military intelligence (GRU) hacking group, formally designated Unit 74455 within the GRU's Main Center for Special Technologies (GTsST). The US DOJ indicted six Sandworm officers in 2020 for attacks including NotPetya, the Olympic Destroyer attack, French election interference, and Ukraine power grid attacks.

What made NotPetya historically significant?

NotPetya (June 2017) was the most destructive cyberattack in recorded history, causing approximately $10 billion in global damage by spreading uncontrollably beyond its initial Ukrainian targets to devastate multinational corporations globally—including Maersk, Merck, FedEx's TNT, and many others. It demonstrated that cyberweapons designed for targeted geopolitical use can cause catastrophic global collateral damage.

How are malware families tracked and named?

Security companies typically name malware families they discover (often after discovery location, internal strings, or behavioral characteristics) and publish technical reports with indicators. The community then tracks relationships through shared indicators (hashes, C2 infrastructure, code similarities). There is no single authority, so different researchers may use different names for the same malware (e.g., Industroyer is also called Crashoverride).

What is the significance of code reuse in malware attribution?

Code reuse analysis—identifying similar functions, algorithms, or programming patterns across different malware samples—provides attribution evidence independent of infrastructure indicators (IP addresses, domains) that can be easily changed. When new malware shares unique code with previously attributed samples, this strongly suggests the same development team, supporting attribution to the same threat actor.

Sources

1. Mandiant, "APT44: Unearthing Sandworm," April 2024
2. ESET, "Industroyer2: Industroyer reloaded," April 2022
3. ESET, "HermeticWiper: New Data-Wiping Malware," February 2022
4. US DOJ, "Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware," October 2020
5. Microsoft MSTIC, "MSTIC Intelligence Digest: Destructive Malware Targeting Ukrainian Organizations," 2022