Wiper malware is destructive software designed to erase data or make systems unusable. Unlike ransomware, it does not aim to collect a payment: there is usually no working way to get the data back. Some wipers pose as ransomware to hide their real purpose.

How it works

• It overwrites files with random data so they cannot be recovered by forensic tools (MITRE ATT&CK T1485, Data Destruction).
• It wipes raw disk sectors or boot structures such as the master boot record (T1561, Disk Wipe).
• It may delete backups and shadow copies first to block recovery.
• It is often spread across the network at once with admin tools or group policies.

Why it matters for defenders

Wipers are used in sabotage, often linked to geopolitical conflict, and sometimes to cover up other activity after data has been stolen. The impact can halt operations completely. The main defenses are offline and tested backups, network segmentation, limited admin rights and an incident response plan that assumes some systems will be lost. Since wiper attacks are often preceded by intrusion and data theft, finding stolen access or leaked data early can give a warning before the destructive stage.

Sources: MITRE ATT&CK T1485: Data Destruction, MITRE ATT&CK T1561: Disk Wipe