Wipers from Russia’s most cut-throat hackers rain destruction on Ukraine

Wipers from Russia’s most cut-throat hackers rain destruction on Ukraine, with Sandworm and other Russian-state groups unleashing data-destroying payloads on Ukrainian targets. In April, the group targeted a Ukrainian university with two wipers, one tracked as Sting and the other as Zerlot; Sting was designed to schedule a task named DavaniGulyashaSdeshka, a phrase drawn from Russian slang, according to ESET.

Later, in June and September, Sandworm released multiple wiper variants against a range of critical infrastructure including government, energy, and logistics sectors, and there was also a fourth, less common target: Ukraine’s grain industry. Not all attacks have been attributed to Sandworm, with some incidences spread by groups operating for other arms of the Russian government, and ESET notes collaborations between groups are uncommon given rivalries.

The report highlights that wipers remain a long-standing tool of Kremlin-aligned actors and are likely to persist, with Sandworm conducting wiper attacks against Ukrainian entities on a regular basis since the start of 2025.