malware

WhisperGate S0689

Type: malware
Platform: Windows
Created: 10 March 2022
Last modified: 10 April 2024

WhisperGate is a multi-stage wiper designed to look like ransomware that has been used against multiple government, non-profit, and information technology organizations in Ukraine since at least January 2022.[1][2][3]

TechniquesTop 9%

TacticsTop 20%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0689

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects the use of commands to add or set exclusions in Windows Defender. It (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Nasreddine Bencherchali, Splunk	2021-11-25	2026-06-08	773b66fe-4dd9-11ec-8289-acde48001122
	Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-09-02	2024-03-19	d7662ff6-9e97-4596-a61d-9839e32dee8d
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
Splunk	The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Network Share Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-10-24	2026-05-13	9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-10-09	1fac1481-2dbc-48b2-9096-753c49b4ec71
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Generic	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-12-02	0bcfabcb-7929-47f4-93d6-b33fb67d34d1
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
	Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts	Generic	test	ps_script	windows	PowerShell	Defense Impairment Disable or Modify Tools	-	high	Florian Roth (Nextron Systems)	2022-11-09	—	e0d6c087-2d1c-47fd-8799-3904103c5a98
	Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...)	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-12-25	—	aa37cbb0-da36-42cb-a90f-fdf216fc7467
	Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	@kostastsale, Nasreddine Bencherchali (Nextron Systems)	2023-11-05	2024-08-16	31e124fb-5dc4-42a0-83b3-44a69c77b271
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects suspicious user agent strings used in APT malware in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems), Markus Neis	2019-11-12	2024-02-15	6ec820f2-e963-4801-9127-d8b2dce4d31b
	Detects suspicious user agent string of APT40 Dropbox tool	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	high	Thomas Patzke	2019-11-12	2023-05-18	5ba715b6-71b7-44fd-8245-f66893e81b3d
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use (...)	Generic	experimental	process_creation	linux	Linux Auditd	Defense Impairment Disable or Modify Tools Privilege Escalation, Stealth Process Injection Proc Memory	-	high	Milad Cheraghi	2025-05-26	2025-12-05	e497a24e-9345-4a62-9803-b06d7d7cb132
	Detect changes in auditd configuration files	Generic	test	file_event	linux	Linux Auditd	Defense Impairment Disable or Modify Tools	-	high	Mikhail Larin, oscd.community	2019-10-25	2021-11-27	977ef627-4539-4875-adf4-ed8f780c4922
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
Splunk	The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	medium	Bhavin Patel, Splunk	2025-03-25	2026-05-13	8b4e3d62-f743-11ee-9f6e-acde48001123
	Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-07-10	—	59b70e4d-dd17-44a9-b740-acf07ae3eb6a
	Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety c (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-07-10	—	1c722651-254a-4b04-a9f4-99b62a2d0a1f
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects when a EFS Fileshare Mount is modified or deleted. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	medium	Austin Songer @austinsonger	2021-08-15	2022-10-09	6a7ba45c-63d8-473e-9736-2eaabff79964
	Identifies when an EKS cluster is created or deleted.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	low	Austin Songer	2021-08-16	2022-10-09	33d50d03-20ec-4b74-a74e-1e65a38af1c0
	Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	high	suktech24	2025-11-27	—	d2656e78-c069-4571-8220-9e0ab5913f19
	Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	high	faloker	2020-02-11	2022-10-09	6e61ee20-ce00-4f8d-8aee-bedd8216f7e3
	Detects evade to Macie detection.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Sittikorn S	2021-07-06	2023-03-24	91f6a16c-ef71-437a-99ac-0b070e3ad221
	Detects the modification of the findings on SecurityHub.	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	high	Sittikorn S	2021-06-28	—	a607e1fe-74bf-4440-a3ec-b059b9103157
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...)	Emerging	experimental	dns	-	-	Command and Control Application Layer Protocol Web Protocols Command and Control Dynamic Resolution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	73e5d24f-493f-4092-bd2f-c72cabda40ee
Splunk	The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...)	Generic	stable	account_management	-	Microsoft 365	Defense Impairment Disable or Modify Tools	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-05-13	875de3d7-09bc-4916-8c0a-0929f4ced3d8
	Detects when a Container Registry is created or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	low	Austin Songer @austinsonger	2021-08-07	2022-08-23	93e0ef48-37c8-49ed-a02c-038aab23628e
	Identifies when a device or device configuration in azure is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Data Manipulation Stored Data Manipulation	-	medium	Austin Songer @austinsonger	2021-09-03	2022-10-09	46530378-f9db-4af9-a9e5-889c177d3881
	Detects when a Azure Kubernetes Cluster is created or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	low	Austin Songer @austinsonger	2021-08-07	2022-08-23	9541f321-7cba-4b43-80fc-fbd1fb922808
	Detects when Events are deleted in Azure Kubernetes. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Defense Impairment Disable or Modify Tools	-	medium	Austin Songer @austinsonger	2021-07-24	2022-08-23	225d8b09-e714-479c-a0e4-55e6f29adf35
	Identifies when a Azure Kubernetes network policy is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	08d6ac24-c927-4469-b3b7-2e422d6e3c43
	Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	25cb259b-bbdc-4b87-98b7-90d7c72f8743
	Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	7ee0b4aa-d8d4-4088-b661-20efdf41a04c
	Identifies when ClusterRoles/Roles are being modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	818fee0c-e0ec-4e45-824e-83e4817b0887
	Identifies when a service account is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Account Access Removal Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	12d027c3-b48c-4d9d-8bb6-a732200034b2
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
	focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cob (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	critical	ok @securonix invrep_de, oscd.community	2020-10-09	2022-12-25	8d31a8ce-46b5-4dd6-bdc3-680931f1db86
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a

Title

Description

WhisperGate S0689

WhisperGate S0689

WhisperGate MITRE reference S0689

Standing S0689

Reach

Coverage

WhisperGate detections S0689