No key to buy: WhisperGate and the agency recovery plan

The week

In January 2022, Russian forces were massing on Ukraine’s borders, and the tension was spilling into cyberspace.

The warning before the attack

On January 11, CISA, the FBI and the NSA issued a joint advisory on Russian state-sponsored threats to US critical infrastructure. CISA, the Cybersecurity and Infrastructure Security Agency, is the federal body responsible for helping US organizations, from water utilities to county governments, defend their computer systems. A joint advisory from all three agencies is their way of saying: pay attention now.

The advisory asked defenders to adopt a heightened state of awareness and to hunt actively for intruders. It recalled earlier Russian operations that had used destructive malware against industrial systems, including the attacks on Ukraine’s power grid in 2015 and 2016. Its practical advice was ordinary but pointed. Keep backups offline and test restores. Exercise incident response and continuity plans. For operational technology, plan how to keep running if control of the network is lost.

Defacements, then a wiper

A few days later, in mid-January, a number of Ukrainian government websites were defaced, their home pages replaced with the attackers’ own messages. That was visible and embarrassing, but defacement is usually more propaganda than damage. What came next was more serious.

On January 15, Microsoft disclosed that it had found destructive malware on systems at multiple Ukrainian government agencies and organizations. Malware is malicious software, a program written to do harm. Microsoft said the malware had first appeared on victim systems on January 13. It counted dozens of affected systems at government, non-profit and information technology organizations in Ukraine, and warned the number could grow.

This program, later widely called WhisperGate, was dressed up to look like ransomware. It displayed a ransom note, the familiar message telling a victim their files are locked and they must pay to get them back. The note asked for $10,000 in bitcoin and gave a contact address for a messaging service.

But the note was a costume. Behind it, the malware overwrote the disk’s master boot record and corrupted files, with no mechanism for recovery. The master boot record is a small section at the very start of a computer’s hard drive that tells the machine how to start up; overwrite it, and the computer cannot even boot. There was nothing to buy back. Paying would have achieved nothing, because the attackers had built no way to undo the damage. Security professionals call this kind of program a “wiper.”

How it worked

Microsoft’s analysis described two stages. The first replaced the boot record with the fake ransom note, and took effect when the machine was powered down. The second downloaded a file corrupter that searched for files with a long list of common extensions, including documents, databases, images, archives and virtual machine files. It overwrote their contents with junk data and renamed them.

Microsoft pointed out details that gave the game away. Real ransomware notes usually carry a unique identifier for each victim, so the criminals know whom they are negotiating with. This note had none. The file damage was overwriting, not encryption, so there was nothing a key could reverse. Microsoft assessed that the malware was designed to make devices inoperable rather than to raise money.

The first stage was also launched with a widely available administration toolkit that runs commands on remote machines using valid credentials. That pointed to attackers who already had a foothold and the logins to move around.

The response in Washington

On January 18, CISA published guidance urging US organizations to take immediate steps to reduce the likelihood and impact of a potentially damaging intrusion. It was written for senior leaders at every organization, regardless of sector or size. It referred directly to the reports of destructive malware in Ukraine, and to earlier destructive malware such as NotPetya.

Its steps came in four groups: reduce the likelihood of an intrusion, detect one quickly, be ready to respond, and maximize resilience to a destructive incident. The last group asked organizations to test that critical data could be restored rapidly after ransomware or a destructive attack, and to keep backups isolated from network connections. It also asked them to name a crisis-response team covering technology, communications, legal and business continuity, and to run a tabletop exercise.

For US state agencies, counties and cities, that guidance carried an uncomfortable implication. Many had planned for ransomware, a crime with a business model. WhisperGate was a reminder that some attackers have no interest in being paid at all.

Ransomware had shaped how US public agencies imagined a worst-case cyber event. Ransomware is extortion. Its operators want to be paid, so they keep a way to restore data. However distasteful, payment remains somewhere in the decision tree, and many continuity plans assumed, without saying so, that it could be the final fallback.

WhisperGate borrowed ransomware’s look without its economics. The note was a disguise, and there was no key for sale. For a state agency, a county or a city, a wiper turns every recovery assumption into a test of the agency’s own backups and rebuild capability.

The difference bites at three stages: telling a wiper from ransomware, containing it, and rebuilding from nothing. A first section sets out why extortion and destruction differ. The three stages follow in order. Then come a county’s long weekend run two ways, what the gap costs elected officials and residents, how agencies prepare, and the questions to ask before the next ransom note.

Extortion versus destruction

Ransomware works like a burglar who changes the locks on your house and offers to sell you the new key. It is a crime, but a commercial one. Ransomware scrambles an organization’s files using encryption, a mathematical method of locking data so it can only be read with the right digital key. The criminals hold the key and sell it back. Because their income depends on victims believing that payment works, the better-organized gangs generally make sure it does.

A wiper is a burglar who burns the house down and leaves a note pretending to sell a key. There is no key. Some wipers overwrite data with junk; others, like WhisperGate, destroy the structures a computer needs to start up and then corrupt the files themselves. The goal is disruption, not money, which is why wipers are associated with conflicts between states rather than with ordinary crime.

The precedent agencies had already seen

WhisperGate was not the first wiper in costume. In June 2017, NotPetya spread from a compromised update to a Ukrainian accounting program and moved across networks worldwide. It, too, displayed a ransom note, and paying it restored nothing. Multinational companies with Ukrainian offices lost thousands of machines in hours. The US and UK governments later attributed it to the Russian military. CISA’s January 18 guidance named NotPetya directly.

The NotPetya episode taught two things that applied in 2022. First, a wiper aimed at one country can travel through ordinary business connections to organizations that were never the target. Second, recovery depended on the victim’s own records. Widely reported accounts of the shipping company Maersk’s recovery describe a global network rebuilt from a single surviving copy of its directory. That copy was found on a server in an office that had been offline during the attack.

Why the difference matters to a plan

The practical difference for a leader is stark. Facing ransomware, an organization has two broad routes back: restore from its own backups, or, as a last and contested resort, negotiate. Facing a wiper, there is only one route. Everything rests on whether the organization can rebuild from copies it controls, and how long that takes.

That matters because many public agencies had never been forced to answer the second question honestly. Their plans said “restore from backup,” and the existence of a possible fallback, however unwelcome, meant nobody had stress-tested what full restoration would actually involve.

The fallback was also narrowing for reasons that had nothing to do with Russia. By 2022, North Carolina and Florida had passed laws barring state agencies and local governments from paying ransoms. Cyber insurance had become more expensive and harder to obtain. For agencies in those states, every ransomware incident was already a wiper in planning terms. WhisperGate made the same point for everyone else.

Telling a wiper from ransomware

A destructive attack dressed as ransomware is built to waste the first hours. The note invites the victim to contact the attacker, open a negotiation and wait. Meanwhile, the damage completes. Incident response playbooks that branch on “is this ransomware?” can send the team down the wrong path if they accept the note at face value.

An incident response playbook is a pre-written set of steps for handling a cyber attack. Its value is that people under pressure follow a checklist rather than improvising. Its weakness is that if the first question is answered wrongly, every step afterwards follows the wrong branch.

What the evidence looks like

Classification should rest on evidence, not on what the malware says about itself. Early questions include whether the boot record or disk structures have been overwritten, whether files are encrypted with a recoverable scheme or simply corrupted, and whether the sample matches known destructive families. Those answers take forensic skill: the ability to examine affected systems and malicious code and reconstruct what happened. Most small and mid-sized agencies do not have it in-house.

Some signals are visible to a non-specialist. WhisperGate’s note lacked a victim-specific identifier, which criminal operators need to match payments to keys. Its corrupted files had been overwritten with a repeating pattern, so their contents were gone rather than scrambled. A team that knows to look for such signs, and to send samples to an expert, can reclassify an incident within hours instead of days.

Getting an expert on the line

The practical control is a pre-arranged incident response retainer that can put an analyst on the problem within hours, whether through the state, a cooperative contract or an insurer. Its terms are agreed in advance, so nobody is negotiating a contract in the middle of an incident. Many states had begun offering such services to localities, and those arrangements were worth confirming that month.

Retainers differ in what they actually promise. Some guarantee a response time for a call, not for an analyst working on the agency’s systems. Some require the agency to have specific logging or endpoint tools already in place. Some insurer panels require notice to the insurer before any outside firm is engaged. An agency should read its retainer the way it reads a mutual aid agreement: for what happens at 2 a.m., not for what the brochure says.

Rehearsing the wrong branch

A tabletop exercise is the cheapest way to test classification. Most agencies that run one use a ransomware scenario, because it is familiar. A more useful version starts the same way and then changes the facts partway through. The forensic team reports that files have been overwritten, not encrypted, and that the note has no victim identifier.

The point of the change is to watch what the room does. Some teams keep following the ransomware branch, asking about the insurer’s negotiator and the price of a key. Others stop and switch to rebuild planning. The exercise shows whether the playbook has a branch for destruction at all, and whether anyone has authority to switch to it. It also shows whether the people in the room know what the rebuild sequence would be.

It also shows who is missing. Wiper scenarios quickly need the payroll manager, the communications director and the people who run life-safety systems. A tabletop held only with IT staff tends to end at the moment the real decisions begin.

Who else needs to know

Classification also changes who gets called. A suspected state-sponsored wiper during an international crisis is a national security matter as well as a local outage. Agencies need to know in advance how to reach CISA and the FBI, and for state and local governments, the state fusion center and emergency management agency. Fusion centers are state and regional hubs where federal, state and local agencies share threat information. Those contacts work far better when they already know the agency’s name.

Reporting carries a second benefit. A wiper hitting one county may be hitting others through the same vendor or the same stolen credentials. Early reports let federal and state partners warn neighbors before the same thing happens to them. CISA’s January 18 guidance asked organizations to report incidents and unusual activity to CISA or the FBI for exactly that reason.

Containing something that wants no ransom

Ransomware operators often spend weeks in a network before encrypting, because they want the strongest possible hand in a negotiation. A wiper deployed for disruption may act faster and with less discrimination. Containment therefore depends on decisions made in the first hour, and on design choices made long before.

The first-hour decision: authority

Someone must be able to order networks disconnected, VPN access cut and domain controllers isolated, at night and on weekends, without convening a committee. A VPN, or virtual private network, is the secure tunnel staff use to reach internal systems from home. Domain controllers are the servers that check every user’s password and decide what each person and computer may access.

Pulling those plugs is disruptive. It may take services offline for residents and staff. That is exactly why authority matters. In many local governments it was unclear, split between an IT director, a county administrator and elected officials. Writing down who decides, and their deputies, is cheap. Discovering at 2 a.m. on a Saturday that nobody is sure is expensive.

Authority needs limits as well as a holder. A useful pre-approval names what the on-call executive may do without further sign-off, such as disconnecting internet links, disabling remote access and isolating server segments. It also names what needs more, such as shutting down a 911 support system or a jail management system. The distinction lets the first hour move fast without anyone improvising on life-safety systems.

The first-hour decision: do not make it worse

Some instincts help a wiper. WhisperGate’s first stage took effect when a machine was powered down, so rebooting machines to “see if they come back” could finish the damage. Restoring backups onto a network where the attacker still holds administrator credentials can hand the attacker fresh targets. Agencies benefit from a short list of things not to do until an expert has looked, printed and kept with the playbook.

The design choices: segmentation and privileged access

A wiper that reaches domain administrator credentials can push itself to every joined machine through ordinary administrative tools. Domain administrator credentials are the most powerful logins on the network, the ones IT staff use to install software and change settings everywhere at once. In the wrong hands, the same convenience that lets IT update a thousand computers on a Tuesday lets an attacker destroy them.

Separating administrative accounts for servers, workstations and identity systems, and limiting which hosts can reach which, decides whether a wiper takes one department or the whole jurisdiction. This limiting is called segmentation.

Agencies that share a domain across police, courts, public works and finance have the widest exposure, because one compromise reaches all of them. Sharing a domain is often a sensible cost decision when it is made. It becomes a risk decision the moment someone hostile gets inside.

How exposure differs by type of agency

The shape of the risk depends on how a government is organized. A state that has consolidated IT under a central agency may run one identity system for dozens of departments. That brings strong central security staff, but also a single target. A county with separately elected officers often has the opposite problem. The sheriff, the clerk of court and the treasurer may each run their own systems, with uneven controls and no single person able to order a disconnection across all of them.

Small towns and special districts, such as water, fire or transit authorities, often rely on one IT employee or a managed service provider. Their exposure runs through that provider’s remote management tools. The Kaseya attack in July 2021 had shown how ransomware delivered through a managed service provider’s software could reach many downstream customers at once. A wiper using the same path would leave no one to negotiate with.

Courts and election offices bring their own constraints. In some states, courts run on systems managed by the state judiciary rather than the county; in others, the county hosts them. Either way, the court’s recovery depends on decisions made by a separate branch of government, which needs its own contacts and its own place in the restore order. Election offices face a calendar. Election infrastructure has been designated critical infrastructure since 2017. A destructive attack in the weeks before an election would test voter registration, ballot preparation and result reporting under a deadline no one can move. Those offices tend to plan for paper fallbacks, which is the right instinct for a wiper.

Law enforcement adds a further layer. Systems that handle criminal justice information must meet the FBI’s CJIS Security Policy, which sets requirements for access control and authentication. A segmented police network built to meet that policy may survive an attack on the rest of the county, provided it does not share administrative accounts with it.

Rebuilding from nothing

With a wiper, recovery means restoring from backups and rebuilding what cannot be restored. Four things decide how long that takes:

• Whether the backups are isolated, so that credentials in the production directory cannot delete or encrypt them.
• Whether restores have been tested at scale, or only for single files and single servers.
• Whether the agency can rebuild its directory service, since nothing else authenticates without it.
• Which public services come back first, and who decided.

The first point deserves explanation. The “production directory” is the live system of user accounts that runs day-to-day operations. If the same accounts that manage everyday systems can also manage the backups, then an attacker who steals those accounts can destroy the backups too. Isolation means the backups are kept behind separate credentials, or on storage that cannot be changed once written, so that they survive an attack on everything else.

What isolation means in configuration

Isolation is a set of specific choices. The backup server is not joined to the main domain. Its console requires its own login with multifactor authentication. At least one copy is offline or held on immutable storage, which refuses changes or deletion until a set retention period ends. Retention runs long enough to reach back before the attacker’s likely arrival, which may be weeks. CISA and the FBI’s February 2022 advisory on the Ukrainian wipers added a further warning: treat centralized backup servers as a possible route for spreading malware, and protect them accordingly.

Each choice has a cost. Immutable storage costs more and makes routine cleanup harder. Longer retention means more storage. A separate backup login is one more credential for a small team to manage. These are modest sums next to a rebuild, but they need a line in the budget, because they rarely survive as an unfunded instruction.

Why identity comes first

Many agencies had never restored their full environment and did not know their real recovery time. A plan that says “restore from backup” hides a sequence: rebuild identity, restore core infrastructure, restore applications in priority order, reimage endpoints, and reissue credentials. Reimaging an endpoint means wiping a laptop or desktop and reinstalling a clean, known-good setup. Each step has dependencies and staffing limits. Run end to end, the sequence often takes weeks, not days, in organizations that have only tested pieces of it.

The order of that sequence is not arbitrary. Almost every modern system asks “who are you?” before it does anything, and the answer comes from the directory service. Restore a finance application without the directory, and nobody can log in to it. Restore the directory from a copy the attacker had already tampered with, and you may hand the keys straight back. So the first and often slowest job is rebuilding a clean identity system, which in turn needs trusted servers, a working network and staff who know how to do it under pressure.

That is why recovery times surprise people. A board member might expect IT staff to press a “restore” button. Instead, a team works through dependencies one layer at a time, often with too few people who understand the older systems. Each critical application may also need its vendor’s help, and that vendor may be supporting other customers at the same moment.

The documents that make a rebuild possible

A rebuild also depends on information that is usually stored on the very systems that were destroyed. The February 2022 advisory listed what to keep: installation media and patches, firmware, application installers, license keys, network diagrams and recovery playbooks, including hard copies of checklists. An agency that keeps those in a separate, protected location, and on paper for the most critical steps, saves days of searching and guessing.

Some agencies go further and keep a minimal, isolated recovery environment ready: a small set of clean servers, separate from production, where identity and core services can be rebuilt and tested before reconnecting anything. Others arrange with a neighboring jurisdiction or the state to borrow capacity. Both approaches cost money that sits idle until the worst day. Their value can only be judged against the measured cost of rebuilding without them.

Setting the restore order

The fourth question, which services come back first, is a policy decision dressed as a technical one. IT can say how long each system takes to restore. It cannot decide whether permitting matters more than parks reservations, or whether the jail’s records system outranks the treasurer’s. Those calls belong to the agency head or the governing body, made in advance and written down.

A useful method starts from services, not systems. For each public service, the agency lists the systems it depends on and the longest outage it can tolerate before harm to residents or staff. Payroll, for instance, may depend on timekeeping, the finance system, the directory and a file transfer link to the bank. If any one of those is missing, payroll does not run.

The same exercise identifies manual workarounds. Some payroll teams keep the last pay file so they can repeat it in an emergency and correct the differences later. Dispatch centers often have paper procedures for a loss of their computer-aided dispatch system. Workarounds of this kind buy time for the rebuild, but only if staff have practiced them and the necessary files exist somewhere other than the systems that were lost.

Vendor-hosted systems

Many agencies now rely on systems run by outside companies: a permitting platform, a payroll service, a records system in a vendor’s data center. Those can survive an attack on the agency’s own network, which is helpful. But they create a different question. If the vendor is the one hit, can the agency get its data out, in a usable form, and run the service another way for a while? A vendor-hosted system with no export is a single point of failure the agency does not control.

Cloud services also change, but do not remove, the identity problem. An agency that signs in to its cloud email and file storage through a cloud directory has moved the crown jewels, not eliminated them. An attacker with global administrator rights in that directory can delete mailboxes, files and accounts. Retention settings, separate break-glass accounts and an understanding of what the provider will and will not restore belong in the same plan.

Measuring it

The most useful exercise is a recovery test that assumes total loss of the primary environment, identity included, and measures time to restore a short list of critical public services. Typical candidates are 911 and dispatch support systems, payroll, benefits payments and permitting. The exercise usually exposes single points of failure, such as one data center, one backup administrator or one vendor-hosted system with no export. It also produces a number that budget committees understand.

A full test does not need to take down production. Many agencies start with a tabletop that walks through each dependency in order, then restore identity and one critical application into an isolated environment, timing each step. Each test adds a service. Over two or three years, the agency builds a measured recovery time for the services that matter most, and a list of what slowed it down.

Communication belongs in the rebuild plan. If the agency’s website, email and phone system are gone, residents still need to know which services are available and where to go. Pre-arranged alternatives, such as a page hosted by the state, social media accounts with recovery codes stored offline, and printed contact lists, let an agency speak while it rebuilds.

One county’s long weekend, two ways

Suppose that on a Friday evening, screens across several departments of a county government go dark and display a ransom note. The help desk follows its playbook, which begins: “If ransomware, contact the county’s insurer and do not engage the attacker.” The insurer’s line takes calls, but the county’s response firm cannot get an analyst on site until Monday.

Over the weekend, more machines fail. Nobody is sure whether the IT director or the county administrator can order the network disconnected, so it stays connected until Saturday afternoon. By then, the malware has used an administrator account to reach most county computers, because police, courts and finance share one domain. The backup server is joined to the same domain, and its data has been destroyed too.

On Monday, the analyst confirms what the note concealed: the disks were overwritten and there is nothing to decrypt. The county now faces a rebuild from offline copies that are weeks old, and a sequence it has never rehearsed. Payroll is due on Friday.

Now run the same weekend with different preparation. The playbook asks for evidence before classification, and a state-provided retainer puts an analyst on a call within hours. A named on-call executive orders the network disconnected on Friday night. Police and finance are in separate segments, so the damage stays in two departments. Backups are isolated and were restored in a total-loss exercise last year, so the team knows payroll can be back within a set number of days. A page on the state’s website tells residents which offices are open. It is still a bad week, but not a catastrophe.

The differences between the two weekends were all decided months earlier. Nothing the county did after Friday evening could have created an isolated backup, a segmented network or a tested recovery sequence. What the county could do on the day was use them, and only if someone had the authority to act.

Keeping promises to residents

For an elected official or agency head, the issue is whether the organization can keep promises to residents when its computers are gone.

The costs are direct: overtime, emergency contractors, replacement hardware and delayed revenue from permits and fees. The risks reach further. Dispatch support, benefits and payroll touch public safety and people’s livelihoods. Staff morale suffers when employees spend weeks on paper workarounds. Oversight bodies, auditors and the press will ask what the agency knew and when, and a jurisdiction that received federal warnings in January and had not tested its backups will struggle to answer well.

There is also a budget argument. Recovery capability is invisible until it is needed, which makes it easy to defer. A measured restore time, in days, for named services gives a council or legislature something concrete to weigh. “It would take us three weeks to pay staff” is a sentence that gets funding discussed.

The counter-argument: wipers are rare, ransomware is not

The strongest objection is about priorities. State-sponsored wipers aimed at US local governments were, and remain, rare. Ransomware gangs, phishing and fraud hit counties every year. Spending scarce money on a scenario borrowed from a war zone could look like gold-plating.

The objection is right about frequency and wrong about the remedy. Almost everything a wiper demands, isolated backups, a rehearsed rebuild, clear authority and segmentation, is also what defeats ransomware without payment. An agency that cannot pay, by law or by policy, faces the wiper problem every time ransomware strikes. Preparing for total loss is the ransomware plan done properly.

A second objection says the move to cloud services makes all this dated. Fewer servers on site, the argument goes, means less to rebuild. That is partly true. It also moves the critical dependency to a cloud identity system and to vendors’ recovery promises, which need testing just as much.

Staff limits on a rebuild

Rebuilds are limited by people as much as by technology. A county IT team of a dozen cannot reimage a thousand machines in a weekend, and the few staff who understand the older systems tire quickly. Recovery plans that assume everyone works double shifts for three weeks are not plans.

Surge capacity has to be arranged beforehand. Options include emergency contracts with outside firms, mutual aid from neighboring jurisdictions and help from the state. Several states have used National Guard cyber teams to help local governments recover from ransomware. Each option needs pre-agreed terms on access, supervision and cost. A volunteer from a neighboring county still needs an account, a badge and someone to tell them what to do first.

Funding and shared services

The money question had a partial answer that winter. The infrastructure law signed in November 2021 created a State and Local Cybersecurity Grant Program, with $1 billion over four years. States had to produce cybersecurity plans and pass most of the money through to local governments. For a small jurisdiction, shared services funded that way, such as a state-run retainer or a regional backup arrangement, were often more realistic than building everything alone.

Shared services carry their own risk. A regional arrangement that puts many towns’ backups in one place creates a single target. Its design needs the same isolation and testing as any agency’s own, and each member needs to know where it falls in the restore order.

Preparing for an attacker who wants nothing

Preparation for destructive attacks is not glamorous, and most of it also protects against ransomware. It includes:

• An evidence-first playbook that classifies incidents on forensic findings, backed by a retainer that can deliver an analyst within hours.
• Written authority to disconnect networks, with named deputies for nights and weekends and a clear line around life-safety systems.
• Segmentation and separate administrative accounts, so one compromise cannot reach every department.
• Isolated backups that no everyday credential can delete or alter, with retention long enough to predate an intrusion.
• A total-loss recovery test, run end to end, with measured restore times for critical public services.
• Recovery documents kept apart, including network diagrams, license keys and printed checklists.
• A communication fallback that does not depend on the agency’s own website, email or phones.

The failures are the mirror image. Plans assume, without saying so, a fallback that may not exist. Backups are kept on the same network, managed by the same accounts, as the systems they protect. Restores are tested one file at a time and declared successful. Emergency contacts with federal and state partners are looked up for the first time during the incident. And the communications plan relies on the very email system that has just been destroyed.

Sequencing the work

An agency starting from little cannot do everything at once. A sensible order puts authority and contacts first, because they cost almost nothing. Isolating backups and separating administrative accounts come next, because they decide whether recovery is possible at all. Segmentation and the recovery environment follow, since they take longer and cost more. Testing runs throughout, starting small and adding services each cycle.

Progress can be reported in plain measures. Examples include the share of critical systems with an isolated, tested backup, the date of the last restore test for each, and the measured restore time for each named public service. Another is whether every administrator account is separate from a daily-use account. Those numbers mean something to a council, an auditor and an insurer alike.

Before the next ransom note

• If our systems displayed a ransom note tonight, how would we confirm whether the data could be recovered at all, and how quickly could we get an expert on it?
• Who can order the network disconnected at 2 a.m. on a Sunday, and who stands in if they are unreachable?
• When did we last restore our entire environment, identity included, rather than a single file or server?
• How many days would it take to restore payroll, benefits and dispatch support from total loss, and how do we know?
• Which of our critical systems are hosted by vendors, and can we get our data out if their service fails?

With hindsight

WhisperGate was the first of several destructive malware families used against Ukraine in 2022. HermeticWiper appeared the day before the February 24 invasion. On February 26, CISA and the FBI issued a joint advisory on WhisperGate and HermeticWiper, with detailed guidance on backups, recovery documents and containment.

The spillover that followed

On the morning of the invasion, an attack on Viasat’s KA-SAT satellite network knocked tens of thousands of customer modems offline across Europe, as well as several thousand in Ukraine. According to Viasat’s own account, the attackers reached the network’s management segment through a misconfigured VPN appliance. They then used legitimate management commands to overwrite data on the modems. Viasat shipped nearly 30,000 replacement modems to restore service.

Those events confirmed that wipers were part of the conflict’s opening moves, and that the effects of a cyber attack aimed at one country could spill well beyond its borders. The Viasat case also showed a pattern seen in WhisperGate: the attackers used ordinary administrative tools, not exotic exploits, once they had a foothold.

Attribution, years later

In September 2024, the FBI, CISA, the NSA and international partners attributed WhisperGate to a unit of Russia’s military intelligence service, known as Unit 29155. Their joint advisory said the unit had begun deploying WhisperGate against Ukrainian organizations as early as January 13, 2022. It also said the unit had scanned and probed networks in NATO countries, including in sectors such as government, financial services, energy and health care. US prosecutors brought charges related to WhisperGate that year.

Microsoft, which had first disclosed the malware, later tracked the group behind it under the name Cadet Blizzard.

The delay is itself instructive. An agency deciding in January 2022 whether to treat a ransom note as crime or sabotage had no attribution to work with, and would not get one for years. Classification on the day has to rest on technical evidence.

What reached US agencies instead

Widespread destructive attacks on US agencies did not follow. Ransomware against local governments continued. Oakland declared a local emergency after a ransomware attack in February 2023, and Dallas spent weeks restoring systems after one in May 2023. Pro-Russian hacktivists and Iranian-linked actors later tampered with poorly secured water utility controls in the US. The threat to American public bodies did not arrive in the form many feared in January 2022, but it did not go away either. It came from several directions at once, and much of it exploited basic weaknesses rather than sophisticated tools.

Reporting rules also changed. In March 2022, Congress passed the Cyber Incident Reporting for Critical Infrastructure Act, which directed CISA to write rules requiring covered entities to report significant incidents and ransom payments. CISA published its proposed rule in April 2024.

What held up

The more durable lesson concerned recovery. CISA’s January guidance had told organizations to test that critical data could be restored quickly after a destructive attack and to keep backups isolated from network connections. That advice holds for ransomware and wipers alike. An agency able to rebuild from its own clean copies has options against any attacker, whatever their motive. An agency that cannot is at the mercy of whoever gets in first.

By this point in 2026, agencies that have run a total-loss recovery test know their real restore times. Those that have not are still relying on an assumption WhisperGate showed was unsafe.

Recovery is a capability that can be measured, and should be treated as one rather than as a promise written in a plan. Ask for the number, in days, to restore the services residents depend on, and ask when it was last proven. If nobody can answer, that silence is the most important finding in the room, and it is far cheaper to discover in an exercise than in an incident.