Wiperprogrammas

Wiperprogrammas, or wiper programs, are software tools designed to irreversibly destroy data on computer systems. Their primary purpose is data destruction rather than data encryption or ransom collection. Wipers can erase information by overwriting storage sectors, deleting file tables, formatting drives, or compromising firmware so that data becomes unrecoverable. The term typically refers to malicious tools used in cyber operations, but legitimate data sanitization utilities can have similar destructive effects when used incorrectly or with the correct authorization.

Wiper programs can be standalone tools or components of larger malware campaigns. They may be delivered through spear-phishing, drive-by exploits, supply chain intrusions, or exploited vulnerabilities. Some campaigns deploy wipers to target specific sectors or national infrastructure, while others spread more broadly. In many cases, wipers are deployed to hinder investigations or to disguise other destructive activities, and they are sometimes presented as ransomware to mislead observers.

Notable incidents and examples include the Shamoon family, which in 2012 wiped data on thousands of Saudi Aramco workstations, and its later variants. The 2017 NotPetya outbreak caused widespread disruption and data destruction, with multiplication of economic damage; while initially framed as ransomware, many observers regard it primarily as a wiper. Other high-profile operations, such as Olympic Destroyer in 2018, demonstrated the use of wiper-like techniques to disrupt large organizations during politically sensitive events. These incidents illustrate how wipers differ from traditional ransomware by prioritizing irreversible data loss over ransom payments.

Detection and response focus on rapid containment, investigation, and data recovery. Indicators include mass deletions or overwrites, unusual file system activity, abnormal boot or firmware behavior, and the absence of typical ransom notes. Defenses emphasize robust backups (including offline and offline-tested restores), network segmentation, strict access controls, secure boot and firmware integrity, endpoint detection, and incident-response planning.