Trojan.Killdisk is a new disk-wiping malware recently discovered by security researchers. The wiper attacks are targeted towards Ukraine in support of the Russian invasion, and these signatures can also be seen in attacks in Lithuania. Targeted sectors are aviation, defense, IT services, and financial sector.
HermeticWiper (Trojan.Killdisk) is interestingly digitally signed by a certificate issued to Hermetica Digital Ltd (the origin of the name).
Upon execution, HermeticWiper will damage the MBR (Master Boot Record) of the victim’s system, which will render it inoperable. Organizations compromised using this wiper date back to November of 2021. A Microsoft SQL Server vulnerability was also used to attack organizations in Ukraine and along with the wiper, ransomware was also deployed against affected organizations.