August 7, 2019 By David Bisson < 1 min read

Researchers spotted a new malware family called GermanWiper that masquerades as ransomware but destroys affected data even when victims pay the ransom.

Bleeping Computer first learned of GermanWiper on July 30 when victims began posting about it on the site’s forums. According to the researchers, the malware began by leaving a ransom note prompting the victim to pay 0.15038835 bitcoins for a decryption key. But the sample they analyzed didn’t encrypt the victim’s data. Instead, it overwrote each file’s data with ones and zeroes, effectively destroying its contents.

According to Bleeping Computer, digital attackers distributed GermanWiper primarily in Germany through a spam campaign. The attack email masqueraded as a job application from a person named Lena Kretschmer. It contained an attachment named, which carried malicious PDF documents that downloaded the malware’s executable via a PowerShell command.

More Wiper Malware Disguised as Ransomware

Data wipers have been assuming ransomware as a disguise for years. In June 2017, IBM X-Force Incident Response and Intelligence Services (IRIS) analyzed the international outbreak of NotPetya malware and concluded that attackers were not financially motivated; they aimed simply to destroy data.

Just a few months later, SpamTitan reported on Ordinypt, another wiper family that targeted Germany posing as ransomware. Just a few months after that, Cisco Talos observed how some variants of LockerGoga were effectively preventing users from logging back onto their infected systems following the encryption process, thus rendering their infections destructive.

Defend Your Data Against GermanWiper

Security professionals can help defend against GermanWiper by using an endpoint management solution to provide visibility into the company’s assets and help streamline the process of patching known vulnerabilities. Security teams should also employ a layered defense strategy that draws on antimalware solutions, security awareness training and data backups to defend against destructive malware attacks.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today