Skip to content
←Back to glossaryCyber

WhisperGate (Ukraine, January 2022)

Wiper disguised as ransomware launched against Ukrainian government bodies in January 2022, six weeks before the invasion, attributed on September 5, 2024 in a joint statement to GRU Unit 29155.

Definition

On January 14, 2022, dozens of Ukrainian government websites displayed a threatening message in three languages. The next day, Microsoft revealed the other half of the operation: software planted on machines at government agencies and IT contractors. It showed a ransom demand in bitcoin and actually destroyed the boot record and the files. There was no key and nothing to pay. Microsoft called it WhisperGate. Six weeks later, Russia invaded Ukraine. On September 5, 2024, the FBI, CISA and the NSA, with several European and Five Eyes partners, issued an advisory attributing the operation to GRU Unit 29155. Western services link the same unit to the poisoning of Sergei Skripal. The same day, US prosecutors charged five officers. Two lessons for the market. Fake ransomware muddies the characterization on day one: the victim thinks it is ordinary crime, the insurer opens an extortion claim, and the truth is a preparatory military operation. And official attribution comes two and a half years after the facts, long after the claim has been paid, or declined.

Its 7 cross-references, woven across the glossary's 18 categories
WhisperGate (Ukraine, January 2022): Cyber glossary illustration, AlgoPolis
Example

Hypothetical: a Polish IT contractor serving Ukrainian ministries is hit on January 14, 2022. It reports ransomware, and its insurer starts paying for restoration. In late February, the invasion changes the reading: the insurer invokes the policy's war exclusion, drafted before LMA 5564 to 5567, and the claim stays open until the September 2024 advisory.

Read next
CyberWiper malwareMalware designed to destroy or render data irrecoverable, with no intent of ransom, often for sabotage or geopolitical ends.Read the entry →CyberJoint public attributionCoordinated statement by several governments attributing the same cyber attack to a state on the same day: NotPetya on February 15, 2018, Microsoft Exchange on July 19, 2021.Read the entry →CyberAttribution of a cyber operation to a stateWho decides that a cyber attack is state-backed, and how the attribution wording of the LMA cyber war clauses, A or B version, can decide the claim.Read the entry →
Put it to work
SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Related terms
Also known as

WhisperGate, Unit 29155, Cadet Blizzard, WhisperGate wiper

Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.