# On the Development and Deployment of Cyberwarfare I

- Author: Kojin Glick
- Published: 2022-03-01
- Canonical: https://www.kojinglick.com/blog/on-the-development-and-deployment-of-cyberwarefare-I

---

I don't think it's even necessary at this point to highlight the atrocity of the developing conflict in Ukraine. "War bad" is no longer the hot take it used to be, especially when one side of the conflict is both nuclear-capable and internationally cornered. [But as terrifying as the news of Putin readying nuclear forces is](https://time.com/6152076/putin-nuclear-alert-ukraine/), I am much more concerned with what happened hours before [he declared its "special military operation"](https://www.reuters.com/world/europe/russias-putin-authorises-military-operations-donbass-domestic-media-2022-02-24/).

Discovered on February 23rd, mere hours before the start of the latest round of hostilities, ESET research discovered Hermetic Wiper, malware designed to break into digital storage hardware and simply delete everything there

"Breaking. [#ESETResearch](https://twitter.com/hashtag/ESETResearch?src=hashtag_click) discovered a new data wiper malware used in Ukraine today. ESET telemetry shows that it was installed on hundreds of machines in the country. This follows the DDoS attacks against several Ukrainian websites earlier today 1/n"

[ESETresearch](https://twitter.com/ESETresearch), [Feb 23](https://twitter.com/ESETresearch/status/1496581903205511181)

Another Twitter user by the name of [Thomas Roccia](https://twitter.com/fr0gger_) gave a great summary in how Hermetic Wiper works in the following days: 

![The main impacts of Hermetic Wiper are partition and disk corruption, byte overwriting, and anti-forensics](https://cdn.sanity.io/images/s7hkd94g/production/487ad828a39a3d820fb263d772eb8ec82128ede3-1720x1206.png?w=2000&h=2000&fit=max)

It's interesting to track the sudden appearance of a wiper during what can only be described as the year of ransomware. Essentially the difference between a ransomware attack and a wiper is recoverability: ransomware requires hackers to be able to exchange their pilfered data for compensation (typically Bitcoin or other cryptocurrency). Wipers like the one discovered in Ukraine, on the other hand, show no regard for the value of that data. Encrypted data can be recovered. A corrupted hard drive is much harder to ransom. As Roccia notes, one of the benefits of this sabotage is anti-forensic, in other words, covering the attackers' tracks.

This makes sense in context to Putin's escalation of the conflict. Rather than [engaging Russia's digital capabilities in fundraising](https://www.nytimes.com/2022/02/23/business/russia-sanctions-cryptocurrency.html) like in recent years, Putin is now gearing the growing cyberwar towards industrial and financial sabotage. We can expect is that these cyberweapons spill over to neighboring countries and perhaps across the world, and given the influx of major cybersecurity incidents in the last week, it's likely that variants and strains of this malware will be deployed in a similar way to Ukraine: as a clandestine first-strike against possible combatants.