WhisperGate
Software · ATTACK:enterprise:S0689
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0689",
"title": "WhisperGate",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0689",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--49fee0b0-390e-4bde-97f8-97ed46bd19b7",
"external_id": "S0689",
"domain": "enterprise",
"created": "2022-03-10T16:42:36.137Z",
"modified": "2024-04-10T22:13:49.349Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Cybereason WhisperGate February 2022",
"url": "https://www.cybereason.com/blog/cybereason-vs.-whispergate-wiper"
},
{
"source_name": "Unit 42 WhisperGate January 2022",
"url": "https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/#whispergate-malware-family"
},
{
"source_name": "Microsoft WhisperGate January 2022",
"url": "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
}
]
}Explicit source assertions (29)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1542.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03ecffe3-d09c-40f5-bbc8-ffa4acc4bdb4
Cisco Ukraine Wipers January 2022 · Crowdstrike WhisperGate January 2022 · Cybereason WhisperGate February 2022 · Microsoft WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a2872da-8858-45d4-bd78-8ac41fc376eb
RecordedFuture WhisperGate Jan 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13576b41-ec77-418c-b581-d3fa461df941
Cisco Ukraine Wipers January 2022 · Crowdstrike WhisperGate January 2022 · Cybereason WhisperGate February 2022 · Unit 42 WhisperGate January 2022 · Microsoft WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15d6b855-c6c5-404b-8ab1-8dd5687784a0
Cisco Ukraine Wipers January 2022 · Unit 42 WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2bce15a3-cf65-48a5-8a07-1c85c9c33a1a
Cisco Ukraine Wipers January 2022 · Unit 42 WhisperGate January 2022 · Microsoft WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--375253bd-1832-4177-a1b1-92b42a6a599b
Cisco Ukraine Wipers January 2022 · Unit 42 WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1218.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4854028c-5924-478c-b274-a37f3ad5d7d2
Unit 42 WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d10ce98-d1c1-4e26-84c3-a309e7c30313
Cisco Ukraine Wipers January 2022 · RecordedFuture WhisperGate Jan 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5580b0f6-7679-46c3-adb5-270c87f8ef69
Cisco Ukraine Wipers January 2022 · RecordedFuture WhisperGate Jan 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62c20028-7476-4358-8384-93d40cb65222
Unit 42 WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d216f28-e5e1-4d73-abd9-b08f370f9d2b
Cisco Ukraine Wipers January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76e8bb0f-83a5-462b-8f7d-3369da104e67
Cisco Ukraine Wipers January 2022 · Crowdstrike WhisperGate January 2022 · Cybereason WhisperGate February 2022 · Unit 42 WhisperGate January 2022 · Microsoft WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--774a6b5c-bbba-4094-bac3-0fa5e664bf2a
Cisco Ukraine Wipers January 2022 · Crowdstrike WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7976b353-f509-440f-a620-72116e06c30a
Unit 42 WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7de5afb6-3dbf-4c9a-876f-1f7a4aa9d4e0
Unit 42 WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c263b12-46f5-452c-908e-3bc80fba3bf5
Cisco Ukraine Wipers January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90febb12-39b4-4138-99da-93f1e987ac2a
Unit 42 WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97453382-d064-4705-9a63-b21356d4bfce
Cisco Ukraine Wipers January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d53b4b9-999a-48e9-b90f-0030bbdae18d
Cisco Ukraine Wipers January 2022 · RecordedFuture WhisperGate Jan 2022ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S0689
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9200a4f-271b-4b13-864b-a3e21de3c9f2
CrowdStrike Ember Bear Profile March 2022 · Cadet Blizzard emerges as novel threat actor · Mandiant UNC2589 March 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab503692-c6ff-41ab-995a-e658d098b07b
Unit 42 WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af939bf8-559a-494c-ad06-fb3a8b3e0e18
Cisco Ukraine Wipers January 2022 · Unit 42 WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0ecee81-0bbe-4ab9-9618-b245656aabc4
Cisco Ukraine Wipers January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0fee298-25cc-450d-ab7e-a7430c6b3f02
Cisco Ukraine Wipers January 2022 · Crowdstrike WhisperGate January 2022 · Unit 42 WhisperGate January 2022 · Microsoft WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5a1d3dd-89ea-442a-8695-1aea2cbccafa
Cisco Ukraine Wipers January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be51a4cd-8e2b-4605-9f8d-35e4689704f4
RecordedFuture WhisperGate Jan 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c89f4447-e8dc-4b6f-aa52-fade3ced3268
Cisco Ukraine Wipers January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4e0558a-83e2-4d99-bc80-aff1bb367724
Medium S2W WhisperGate January 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f099adef-7e4e-4b52-b4fa-27f7db8389f3
Cisco Ukraine Wipers January 2022 · Unit 42 WhisperGate January 2022 · Microsoft WhisperGate January 2022 · Medium S2W WhisperGate January 2022