Imagine arriving at work only to find that every system in your IT environment is gone. Not encrypted. Not locked behind a ransom demand. Simply gone. No files, no visibility into operations, and no easy way back. That’s the reality of a wiper attack—a form of destructive malware designed to erase, corrupt, or overwrite data and systems, often leaving organizations scrambling to recover from the damage.
Is it possible to defend against them? Of course. Is it simple enough for a small SMB to achieve, or does it require enterprise-grade resilience? It’s complicated. For more, read on.
Key points of this article:
- Wiper malware is designed to destroy data and systems, making recovery significantly more difficult.
- These attacks are frequently linked to geopolitical conflicts and critical infrastructure disruption, but private organizations can be collateral damage.
- Wiper operations often involve weeks or months of preparation before attackers deploy the destructive payload.
- Early detection is critical, as warning signs may appear long before systems are actually wiped.
- Recovery depends less on incident response after the fact and more on resilience measures such as tested backups, segmentation, and visibility across the environment.
- Organizations of all sizes can reduce their risk through layered security controls, strong identity protection, and modern detection technologies.
What is wiper malware, exactly?
A wiper is designed to do one thing only: delete data, making it unusable. Additionally, it can also put systems that said data is on, out of order. Permanently. It’s a vicious sort of malware most often used by nation-aligned attackers to sabotage critical infrastructure, but impact can extend beyond this primary objective.
Wipers can be potent agents to pressure companies and governments into an economically and socially challenging situation—such as forcing power plant shutdowns, for example.
Hence why wiper attacks are deeply targeted and carefully planned, usually taking months to carry out to achieve profound impact. Deployment is much quicker, and as it takes advanced skills to execute, defenders could be caught off-guard by adversarial mastery, especially when smaller critical entities are affected.
In comparison to ransomware
The difference between wipers and ransomware is in intent. While with ransomware there’s a likelihood of quicker recovery (by obtaining a decryptor, paying a ransom, etc.), there’s nothing to negotiate with a wiper attack. So, unless a business has a sound backup policy, it’s likely that wipers will completely cripple their continuity even after the attack has passed.
How do wiper attacks work?
The preparatory phase is perhaps the most important. Since the focus is on pushing for wide impact, skipping the initial access phase would be ideal. Advanced threat actors can do this by:
- Purchasing initial access from brokers
- Phishing for, or purchasing stolen credentials on the dark web
- Brute forcing their access
But critical infrastructure security is usually tight. Networks can be segmented, zero-trust verification policies can be in place, and air-gapping might be employed. Neither of these measures/approaches are foolproof though. It all depends on the degree to which organizations implement their defense in depth models.
A typical wiper attack lifecycle
Most wiper attacks follow a recognizable pattern. Attackers first gain access, then escalate privileges, move laterally, identify high-value systems, and try to weaken defenses or recovery options before deploying the destructive payload. The final stage is usually recovery and rebuilding, which can take far longer than the attack itself if backups, segmentation, and incident response plans were not tested in advance.
What is defense-in-depth?
Defense in depth, in other words, multilayered security, is a cyber defense strategy that seeks to prevent attacks via layered controls across an entire business network.
Types of wiper malware
While all wipers share the same end goal: making systems and data unusable, though not all achieve it in the same way. Some overwrite files and folders directly, others corrupt the master boot record (MBR) or partition tables, preventing systems from starting. More sophisticated variants may combine multiple techniques, targeting backups, network shares, and recovery mechanisms simultaneously to maximize disruption.
In recent years, threat actors have also blended wiper functionality with espionage and sabotage operations, particularly in geopolitical conflicts involving critical infrastructure and government organizations.
Wiper attacks in practice
Let’s say you have a nuclear power plant centrally monitored by an attached office, with remote oversight by state officials. There’s also a distribution network downstream, transforming, storing, and transferring energy to households. This is pretty much a supply chain, with IT devices and humans dotting it at whichever point, the closest being operationally adjacent OT monitoring systems.
Now, it’s not easy to penetrate these usually air-gapped (isolated) and segmented environments, but also not impossible. If one has initial access, they can also establish persistence within an environment, scan a few open ports, discover vulnerable devices, and move laterally until they reach a point at which they’ve compromised an account with extensive permissions.
Wipers usually arrive via phishing (malicious attachments as delivery vectors) or if highly planned, via malicious flash drives, for example—such as detailed in ESET’s GoldenJackal research, where they were used to bridge airgaps.
With enough permissions, it’s time to move in for the kill. Wipers can be spread at this stage, digitally obliterating servers, workstations, and business systems. With the power plant’s IT system’s logic gone, it will hardly work efficiently, unless the plant has automatic industrial control systems (ICS) in place. In any way, this would mean that operators might no longer see what’s happening inside their own systems.
A bit of nuance: Wipers as destructive malware
Wipers make systems unbootable and data unrecoverable. They don’t cause physical damage; the hardware should remain intact. But in environments where digital systems control physical processes, the loss of visibility and control can create unsafe conditions.
In more advanced operations, wiper malware may be used alongside tools designed to manipulate industrial systems (like Industroyer or Stuxnet), amplifying the overall impact beyond the digital domain.
Still, there are a lot of fail-safes involved. When it comes to power generation though, a loss of centralized control may trigger precautionary shutdowns, and prolonged disruptions could easily translate into operational delays and reduced power output as well. Last, but not least, since wipers fully wipe systems, their rebuilds would take a while.
Examples of real wiper attacks
In Europe alone, ESET has detected multiple cases of wipers used against Ukrainian critical infrastructure, especially its energy sector. These include WhisperGate, which posed as ransomware, as well as HermeticWiper and IsaacWiper, used mere hours before Russia’s invasion, targeting government networks and organizations. Other campaigns, including CaddyWiper, showed the same destructive logic: wipers appear where attackers want to cause disruption, degrade recovery, and increase pressure on the victim.
Since then, ESET has continued to observe further wiper activity against Ukrainian targets, including ZEROLOT and SwiftSlicer. In late 2025, Poland, which neighbors Ukraine, had its energy sector targeted with DynoWiper, which ESET attributed to the Russia-aligned Sandworm group with medium confidence.
The thing is that while wipers are for sure less represented in the threat landscape compared to ransomware or extortionware, their impact is much more serious, bringing devastating consequences. Had the DynoWiper attack proceeded, for example, it’s likely an entire Combined Heat and Power Plant1 would have had to shut down, impacting the delivery of energy to multiple well-populated areas.
Read our research blog for more information about DynoWiper and Sandworm.
In 2025, ESET also detected2 a campaign by an actor yet to be named, which used wipers written in Go and targeting victims in Israel’s energy and engineering sectors.
Can legitimate admin tools be abused like wipers?
Wipers are one thing, but they’re not alone in possessing the ability to reset systems. In March 2026, a large U.S.-based medical technology company suffered a major cyberattack attributed to an Iran-linked threat actor. According to public reporting, the attackers likely obtained privileged access to the organization’s Microsoft environment and then leveraged Microsoft Intune to remotely wipe large numbers of enrolled devices, resetting them to factory defaults.
Thus, rather than deploying traditional wiper malware, the attackers appear to have turned the company’s own device-management infrastructure into a destructive tool.
How can you tell if a wiper attack is underway?
Unlike ransomware, wipers often provide little warning before causing damage. However, organizations may observe some crucial signs during the preparatory stages of an attack. These can include unusual privilege escalation, unauthorized account activity, suspicious lateral movement between systems, attempts to disable security controls (with an EDR killer, for instance), and unexpected access to backup infrastructure.
Once the destructive phase begins, indicators may include widespread file corruption, systems becoming unbootable, or multiple endpoints failing simultaneously.
As sophisticated wiper operations frequently involve weeks or months of preparation, detecting attacker activity before deployment is often the best opportunity for defenders to prevent widespread disruption. This is where centralized visibility, threat hunting, and technologies such as XDR and MDR can play an important role.
What damage can wiper malware cause?
For businesses, the damage from wiper malware goes far beyond lost files. Once critical systems are erased or made unbootable, operations can grind to a halt: employees lose access to essential tools, production lines may slow or stop, customer-facing services can go offline, and security teams may be left without the logs and telemetry needed to understand what happened.
The financial and reputational impact can escalate quickly as downtime, emergency recovery, infrastructure rebuilds, customer communication, legal support, and regulatory scrutiny pile up at once. For sectors such as manufacturing, healthcare, energy, logistics, or public services, the consequences may also affect safety or the delivery of essential services. Recovery then depends on more than simply having backups; they need to be clean, isolated, complete, and tested before an attack happens.
Protection tips against wiper attacks
As with other types of cyber threats, defense is possible. However, there are some key considerations based on company size:
Enterprise organizations
Defense should be tailored to an organization’s most critical assets and recovery requirements
Because wipers aim to disrupt business operations, identifying and protecting essential systems should be the primary focus, tailoring security around them.
Maintain offline, immutable, and regularly tested backups of critical systems and data
Wiper malware is designed to destroy or corrupt data, making reliable recovery capabilities one of the most effective defenses against operational disruption.
Segment or airgap critical systems and restrict privileged access
Limiting lateral movement can prevent a wiper from spreading across the environment and reaching high-value assets. This is especially important for entities based in critical infrastructure.
Medium-sized businesses
Prioritize rapid patching and strong identity security, including MFA
Many wiper attacks begin through compromised credentials or exploitation of known vulnerabilities, making these controls highly effective and cost-efficient.
Develop and regularly test incident response and recovery procedures
Fast containment and recovery can significantly reduce downtime if destructive malware is deployed. However, incident response needs to be thoroughly tested and planned, since one can’t go against the unknown without having at least some idea of whether their systems are resilient at all.
The missing link
Before we go further, there’s something that’s been left out of the conversation between enterprises and medium-sized companies—extended detection and response (XDR). As XDR can correlate activity across multiple security domains, it can effectively help identify and contain wiper malware before it spreads widely across the environment. When enabled with an AI-powered detection engine, it’s potentially capable of figuring out malicious behavior before even a security analyst would.
Small businesses
Maintain secure offline backups and verify recovery regularly
For smaller organizations, the ability to quickly restore data often provides the greatest return on security investment against destructive malware. This, either via actual backups, or automatic remediation tech, with which a security product is capable of deploying quick backups on its own.
Deploy endpoint protection and keep systems up to date
Basic security controls can help detect malicious activity early and block common entry points used by malware operators. However, no endpoint product is the same, and you can’t focus just on your computers if there are company phones and even servers in use. Look for an offer that covers all of these at once to cover all the potential gaps.
Where dedicated security resources are limited, AI, automation, and human oversight can improve detection and response
Early identification of suspicious activity may provide a critical opportunity to contain a wiper before widespread damage occurs. A lot of cybersecurity vendors and MSPs now offer managed security even for the smallest of clients, for example, bringing the mean time to detect and response often down to as little as just six minutes.
Conclusion
Wiper attacks are a reminder that not every cybercriminal is looking for a payout. Some actors are looking to disrupt and destroy. Whether deployed as part of geopolitical operations, attacks against critical infrastructure, or as advanced campaigns against businesses, wipers leave little room for second chances.
Thus, when it comes to wipers, resilience wins. The best defense is understanding your risks before attackers do. Because when destructive malware strikes, backups, visibility, and tested incident response plans may be the only things standing between continuity and end of business.
FAQ: Wipers
What is wiper malware?
Wiper malware is destructive malware designed to erase, overwrite, or corrupt data and systems so they become unusable. Unlike profit-driven malware, its main goal is disruption, sabotage, or operational damage.
How are wipers different from ransomware?
Ransomware encrypts data to pressure victims into paying; wipers are built to destroy or corrupt data instead. Recovery is usually possible only if the organization has clean, isolated, and tested backups.
Who is typically targeted by wipers?
Wipers are often associated with geopolitical conflict and attacks on government, critical infrastructure, energy, logistics, or other high-impact sectors. Private organizations can also be affected as direct targets, collateral damage, or through compromised partners and tools.
What are some real-world examples of wiper attacks?
Known examples include WhisperGate, HermeticWiper, IsaacWiper, CaddyWiper, KillDisk, and DynoWiper. Several of these have been used in attacks linked to geopolitical operations and critical infrastructure disruption.
How can organizations defend against wiper attacks?
Organizations can reduce the risk by combining clean offline backups, network segmentation, strong identity security, rapid patching, endpoint protection, and detection capabilities such as XDR or MDR. The goal is to spot attacker activity before the destructive payload is deployed.
Additional references:
[1] CERT Polska. (2025). CERT Polska energy sector incident report – 29 December (pp. 12–21). https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf. Accessed: 02.07.2026.
[2] ESET Research. (2025). ESET APT activity report Q2 2025–Q3 2025 (p. 12). ESET.
