Wiper Malware Doesn't Leave a Ransom Note

The ransomware playbook starts with a note. A text file on every desktop, a wallpaper change, a demand for cryptocurrency and a countdown timer. Your team knows what they are looking at. They know the decision tree they are entering. They have probably read case studies about it.

Wiper malware does not send a note. The files are gone, or corrupted beyond recovery, or the disk partition table is overwritten. There is no demand. There is nothing to negotiate. The attacker's goal was destruction, not leverage, and they achieved it before you opened your laptop this morning.

The response is different from the first minute, and organizations that have not thought through this distinction find out about it under the worst possible conditions.

What Wipers Are and Who Uses Them

A wiper is malware designed specifically to destroy data rather than encrypt it for ransom. The distinction matters: ransomware operators want to be paid, which means they have an incentive to make decryption work and a reason to limit destruction to what creates pressure. Wiper operators want destruction. There is no negotiation available because there was never a negotiation intended.

Nation-state actors have been the most notable deployers. NotPetya in 2017 disguised itself as ransomware but had no functional decryption mechanism. It was designed to destroy, and it caused an estimated ten billion dollars in damage across shipping, pharmaceutical, logistics, and energy companies before anyone understood what they were dealing with. HermeticWiper, deployed in Ukraine in February 2022 hours before the Russian invasion, was specifically timed to degrade Ukrainian infrastructure at a critical moment.

Criminal groups use wipers too, usually in retaliation after a payment refusal or as part of a pressure escalation where destruction is the backup option if negotiation stalls. The motivation differs from nation-state use, but the operational challenge for defenders is identical: the data is gone, and there is nothing to decrypt.

The Response Tree Has a Different Shape

Standard ransomware response asks two parallel questions: can we recover without paying, and if not, should we pay? Those questions anchor an entire decision tree. Cyber insurance, law enforcement notification, sanctions compliance, and negotiator engagement all hang off the payment question. Most mature incident response programs have thought through this tree at least once.

Wiper response has no payment branch. The tree is simpler but the options are narrower: determine the scope of destruction, validate the state of backups, begin recovery. There is no key to buy. There is no negotiator to hire. The attacker is not waiting to hear from you.

This sounds cleaner than ransomware response, and in one sense it is. But the simplicity cuts in a direction that does not favor the victim: every path leads to recovery from backups, or not at all.

Backup Verification Is the Entire Engagement

In a ransomware incident, backups are important. In a wiper incident, they are the only answer. The question of whether your backups survived and whether they are actually usable is not something you determine in parallel with other response activities. It is the primary activity, and everything else waits on the answer.

This surfaces problems that were always present but never stress-tested. Backups stored on network-attached storage that shared a domain with the destroyed systems are reachable by wiper malware using the same stolen credentials. Backups that were never restored in a test environment may be technically present but practically unusable at the scale a full recovery requires. Incremental backup chains where the full base is months old create a recovery point objective problem that nobody notices until a full restore is actually required.

NotPetya destroyed backup infrastructure at multiple victim organizations before the primary attack was even visible to defenders. This was not an accident. Wiper operators understand that backups are the countermeasure, and sophisticated actors address them before executing the main payload.

Organizations that test backup restore processes on a schedule, use offline or immutable storage that the compromised network cannot reach, and verify recovery point objectives under simulated conditions are the ones that survive this incident type. Not because they stopped the wiper, but because the wiper did not stop them.

Scope Determination Is Harder Than It Looks

Ransomware operators are often accidentally helpful about describing what they hit. The ransom note names the affected systems, the encrypted file types, and sometimes the volume of data exfiltrated. It is adversarial documentation of the incident scope.

Wipers produce no documentation. Scope determination requires active forensics: which systems were affected, in what order, how the malware propagated, and what state each system was in before execution. This is harder and slower than working from a ransom note, and recovery cannot begin confidently until it is reasonably complete.

Wipers that use network propagation mechanisms spread faster than anyone expects. NotPetya used EternalBlue and credential theft to traverse networks at machine speed. Unlike ransomware operators who sometimes manually select targets to maximize leverage without triggering broad alerts, wipers are frequently designed to reach as many systems as possible in the shortest possible time. By the time the first affected system is noticed, the scope may already be much larger than it initially appears.

Forensics during a wiper incident is about determining the blast radius accurately enough to know what needs to be rebuilt, in what order, and whether any systems that appear clean should be treated as potentially compromised. Rebuilding a workstation that looks fine but was in the propagation path and treating it as clean is a way to introduce a problem into a recovered environment.

What Recovery Actually Requires

Recovery from a wiper attack is a rebuild operation. Everything in the blast radius gets rebuilt from known-good state, which means clean backups or fresh installations. The timeline is measured in days to weeks depending on scope and backup infrastructure quality. There is no shortcut that does not introduce risk.

The organizations that recover fastest from wiper attacks are not the ones with the best detection. Wipers, almost by definition, succeed at their purpose before detection is relevant. The ones that recover fastest are the ones with offline backup infrastructure the attacker could not reach, tested restore processes that work at scale, and a documented rebuild priority that does not require real-time decisions under pressure about which systems matter most.

That preparation does not happen during the incident. It happens on a calm Tuesday, reviewed quarterly, practiced before the moment it counts.

The note never arrives. Whether your organization rebuilds in days or months depends entirely on what you built before the attacker showed up.