CyberGlossary

Malware

Wiper Malware

Also known as: Disk wiper, Destructive malware

Definition

Destructive malware whose primary goal is to irreversibly erase or corrupt data, firmware, or boot records — not financial gain.

A wiper is malware designed for destruction rather than profit. It overwrites files, disk sectors, partition tables, or firmware so that affected systems become unbootable and data unrecoverable. Some wipers masquerade as ransomware, displaying a ransom note even though no decryption key exists. Wipers are typical of state-sponsored sabotage, hacktivism and wartime cyber operations, and have been used heavily against Ukrainian infrastructure since 2022. Defences emphasize tested offline backups, immutable storage, network segmentation, robust EDR/XDR, restricting admin tools (PsExec, Group Policy), and rapid containment of suspected destructive incidents.

Examples

  • NotPetya (2017), a wiper disguised as ransomware that caused billions in damage.
  • HermeticWiper and CaddyWiper, used against Ukrainian targets in 2022.

Related terms