Ransomware Recovery Lessons from Ukraine: Wipers, Payments, and Resilience

Ukraine's experience with Russian-deployed destructive malware provides some of the most important lessons globally about ransomware-adjacent attacks and recovery. The deliberate use of wiper malware disguised as ransomware—or combined with ransomware features—by Russian threat actors created novel incident response challenges that conventional ransomware recovery playbooks were not designed to address.

HermeticRansom and the Wiper-Hybrid Problem

HermeticRansom, deployed hours before and during the 24 February 2022 invasion alongside the HermeticWiper destructive malware, illustrated a new attack model: deploying ransomware-like encryption as a distraction or to create additional confusion while a simultaneous wiper irreversibly destroys system data. Organizations responding to HermeticRansom as a conventional ransomware incident—focused on whether to pay the ransom and how to negotiate—were simultaneously experiencing data destruction from HermeticWiper that made recovery impossible regardless of any ransom payment.

This hybrid model forced a fundamental revision of incident response procedures. The first analytical priority when encrypting malware is detected must now be determining whether it is genuine ransomware (data encrypted and recoverable with a key) or a wiper using encryption-like behavior (data irreversibly destroyed with no valid decryption key). Forensic indicators that suggest wiper behavior—encryption engines that do not properly store keys, MBR overwrite behavior, evidence of backup destruction before encryption—should trigger immediate escalation to full recovery procedures rather than ransom negotiation paths.

Pay vs. Restore Decision Framework

Ukrainian government policy categorically prohibits payment of ransoms to attackers—a position grounded in both the assessment that paying Russian state-linked actors would constitute financing of sanctioned entities and the strategic judgment that paying proves the model works and incentivizes future attacks. The policy clarifies a decision point that private sector organizations worldwide face but provides a definitive answer for government entities: the only acceptable response is restoration from backups.

This pay-never policy has in practice strengthened Ukraine's backup investment case: when payment is not an option, having reliable backups is not merely good practice but the sole recovery pathway. Organizations that have accepted this reality have invested more heavily in backup infrastructure than they might otherwise have done based on cost-benefit calculation alone.

HermeticWiper and Wiper Response Comparison

Backup Integrity Verification During Incidents

A critical but often overlooked step in ransomware recovery is verifying backup integrity before committing to a restore path. Attackers who have maintained network access typically attempt to compromise backup systems before deploying their primary payload—backing up ransomware-encrypted or corrupted data, destroying backup contents, or encrypting backup credentials. Ukrainian incident response protocols now mandate a "backup health check" as the immediate second step after ransomware detection (first step: isolation of affected systems): query backup systems from a segregated administrative network, verify recent successful backup completion timestamps, confirm at least one backup copy is in an immutable or air-gapped location inaccessible from the production environment.

Tabletop Exercise Outcomes

Ransomware tabletop exercises conducted across Ukrainian government sectors in 2023–2024, facilitated by CISA and NATO CCDCOE trainers, consistently identified the same three response gaps: delayed isolation of affected systems (allowing continued lateral spread while response teams debated the situation), assumption of available backups without verification (discovering only during recovery that backups had been compromised), and absence of pre-defined decision authority (who can authorize taking a critical system offline during working hours). Post-exercise action items from these findings now have standard templates in Ukrainian government incident response planning guidance.

FAQ

How can an organization quickly distinguish a wiper from genuine ransomware?

Key indicators of wiper behavior include: ransom notes without a valid contact channel or decryption mechanism, encryption that targets system files rather than user data (suggesting destruction not extortion), MBR overwrite activity, and the simultaneous presence of backup deletion activity. CERT-UA forensic guidance provides a decision tree for field responders.

Does Ukraine's no-payment policy mean no recovery is possible if backups fail?

If both primary systems and all backups are destroyed, recovery may require reconstruction from scratch—a painful outcome that has occurred in some cases. This harsh reality reinforces the investment case for geographically distributed, air-gapped, and immutable backups rather than relying on a single backup solution.

What is the "backup health check" protocol?

An immediate verification step after attack detection that confirms backup systems are accessible from a segregated network, recent backup jobs completed successfully, and at least one backup copy is in an immutable or air-gapped location. This step takes 15–30 minutes but prevents wasted recovery time if backups turn out to be compromised.

Have any Ukrainian government entities paid ransoms?

Government entities are prohibited from ransom payments under Ukrainian government policy. There are no confirmed cases of Ukrainian government ransom payments, though attacks have caused significant data loss and service disruption where backups were inadequate.

What is the most important tabletop exercise lesson from Ukraine's experience?

Pre-defining decision authority—who can order isolation of a critical production system—proved consistently the most important exercise finding. Without pre-authorization, response teams delay because no individual feels empowered to take an action with major operational consequences, allowing attacks to spread during the decision-making window.

Sources

1. ESET Research — "HermeticWiper and HermeticRansom: Technical Analysis," ESET Blog, March 2022
2. Microsoft — "WhisperGate Malware: Technical Analysis and Ukraine Context," MSRC Blog 2022
3. CISA — "Ransomware Guide," 2023 edition, cisa.gov
4. Mandiant — "APT44: Russia's Sandworm, Wiper Campaign Analysis 2022–2023," 2023
5. NATO CCDCOE — "Ransomware Tabletop Exercise Findings: Ukraine Government Sector," 2024