Researchers spotted a new malware family called GermanWiper that masquerades as ransomware but destroys affected data even when victims pay the ransom.
Bleeping Computer first learned of GermanWiper on July 30 when victims began posting about it on the site’s forums. According to the researchers, the malware began by leaving a ransom note prompting the victim to pay 0.15038835 bitcoins for a decryption key. But the sample they analyzed didn’t encrypt the victim’s data. Instead, it overwrote each file’s data with ones and zeroes, effectively destroying its contents.
According to Bleeping Computer, digital attackers distributed GermanWiper primarily in Germany through a spam campaign. The attack email masqueraded as a job application from a person named Lena Kretschmer. It contained an attachment named Unterlagen_Lena_Kretschmer.zip, which carried malicious PDF documents that downloaded the malware’s executable via a PowerShell command.
More Wiper Malware Disguised as Ransomware
Data wipers have been assuming ransomware as a disguise for years. In June 2017, IBM X-Force Incident Response and Intelligence Services (IRIS) analyzed the international outbreak of NotPetya malware and concluded that attackers were not financially motivated; they aimed simply to destroy data.
Just a few months later, SpamTitan reported on Ordinypt, another wiper family that targeted Germany posing as ransomware. Just a few months after that, Cisco Talos observed how some variants of LockerGoga were effectively preventing users from logging back onto their infected systems following the encryption process, thus rendering their infections destructive.
Defend Your Data Against GermanWiper
Security professionals can help defend against GermanWiper by using an endpoint management solution to provide visibility into the company’s assets and help streamline the process of patching known vulnerabilities. Security teams should also employ a layered defense strategy that draws on antimalware solutions, security awareness training and data backups to defend against destructive malware attacks.