---
title: "SwiftSlicer: A simple yet dangerous data wiper"
description: On January 25, 2023, ESET Research found a new data wiper in the network of Ukrinform, Ukraine’s national news agency. Later, the Computer Emergency Response Team of Ukraine (CERT-UA) added that as of January 27, five additional, different malware samples were spotted in the network.
canonical_url: https://www.acronis.com/en/tru/posts/swiftslicer-a-simple-yet-dangerous-data-wiper/
locale: en
last_updated: 2026-10-27
---

*   [Home](https://www.acronis.com/en/tru/)
*   [Articles](https://www.acronis.com/en/tru/posts/)
*   [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)

29 March 2023

# SwiftSlicer: A simple yet dangerous data wiper

On January 25, 2023, ESET Research found a new data wiper in the network of Ukrinform, Ukraine’s national news agency. Later, the Computer Emergency Response Team of Ukraine (CERT-UA) added that as of January 27, five additional, different malware samples were spotted in the network.

Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)**

On January 25, 2023, [ESET Research found](https://twitter.com/ESETresearch/status/1618960022150729728?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1618960022150729728%7Ctwgr%5Eaa5819c9a9c346bb52eef6aa97bff90dbd9de935%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fwww.welivesecurity.com%2F2023%2F01%2F27%2Fswiftslicer-new-destructive-wiper-malware-ukraine%2F) a new data wiper in the network of Ukrinform, Ukraine’s national news agency. Later, the Computer Emergency Response Team of Ukraine (CERT-UA) added that as of January 27, five additional, different malware samples were spotted in the network.

These attacks were attributed to the Sandworm APT group, which was active from 2014. Sandworm is responsible for Industroyer, NotPetya, WhisperGate, CaddyWiper, IsaacWiper and other disruptive malware.

## Technical details

### Overview

The analyzed SwiftSlicer sample (SHA256:1db93ee81050da0ba413543f9fbc388499a466792f9a54ea6f1bbdb712ba9690) was written in the Go programming language, and has a fake compilation timestamp. This sample is not packed or obfuscated.

![Image 1: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/57496a9e40e628f0c61a4a3f40621c53.png)

### Execution

Although the SwiftSlicer sample has over 1,800 functions, the wiping preparation and routine are easily located within functions with the ‘main_’ prefix.

![Image 2: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/65943bc0426e9e239bfdefb72437d034.png)

SwiftSlicer probably took its name from the ‘slice’ data type in Go. It has a bunch of functions to work with slices, which are used during execution to store data.

![Image 3: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/e546b61af73376bc536c03eaebf905a3.png)

Execution starts from the ‘main_main’ function. First, SwiftSlicer calls _‘main\_paths()’_ to obtain the _System_ folder path.

![Image 4: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/2f506c30c23d7cf1e8cc30de695d90fd.png)

Besides the System folder, it also obtains some information about the system, user and other system paths.

![Image 5: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/47ad0db4fc23e5be8c665540001de8d5.png)

SwiftSlicer then obtains all available volumes’ path names. The System volume will be marked as ‘_HOMEDRIVE_’.

![Image 6: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/6965fe81be7229d034af8e483cfe0390.png)

Before starting the wiping routine, SwiftSlicer obtains some privileges. This particular operation requires administrative privileges and uses the ‘AdjustTokenPrivileges’ system call.

![Image 7: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/95bb71457e63a9b699d507640f23de71.png)

After this operation has completed, SwiftSlicer’s process has the following privileges:

![Image 8: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/31a6ee9f8ae473a937c480e90d45ea57.png)

It then deletes all shadow copies using the ‘wmic.exe’ process.

![Image 9: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/1d81cad66e97cf018cdea015d3337ad2.png)

Executed command:

![Image 10: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/136ecaec9008f269213f047f9bb39ef5.png)

SwiftSlicer then starts searching for files to wipe. After reading the file on the logical drive, it checks whether it is a folder. If so, it reads its’ subfolders names.

![Image 11: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/f15c1a842a618ee6cae6f5f04d9a996d.png)

After that, it generates its’ full path and saves it in the memory.

![Image 12: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/90e635f62e82e948a297c1d9592819e9.png)

If the current folder doesn’t contain any folders, SwiftSlicer loads the 'main_walkFunk()’ function to the register and calls it.

![Image 13: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/fefff4e73bcd7b719c071308a1ad1e1a.png)

SwiftSlicer corrupts every file on the computer. The first-opened drive is not the System drive, allowing the malware to corrupts users’ files before it breaks the system’s workability. On the System drive, the first folder read is ‘C:\Windows\SysWOW64\drivers’. After listing all directories in this folder, SwiftSlicer loads the first driver file and calls the wipe function.

![Image 14: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/7859a36a6e6a4a3a6832929ff053096e.png)

After obtaining access to the file, SwiftSlicer checks its size.

![Image 15: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/b7246fd51e0f00e5a69262ba2d07a99c.png)

Then, it randomly generates a 128-byte buffer.

![Image 16: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/b2200a5dfd9087e73094215eec886992.png)

This buffer is given as an argument to the ‘os__ptr_File_WriteAt()’ function, where it can be expanded up to 4096 bytes or to the file size.

![Image 17: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/be1dc9f5e664c202d59bfe6d89d2d2ec.png)

Depending on the file’s size, SwiftSlicer starts overwriting it. If the file is smaller than 4096 bytes, the wiper makes one iteration, writing a buffer equal to the file size. If the file is larger than 4096 bytes, it is divided into chunks and then overwritten. Each buffer has different content.

![Image 18: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/e0c5d5eee69c84b9e7a37d9b1a16538c.png)

Here is an example of how it overwrites a large file, making the offset for 4096 bytes after writing the previous buffer. The size of the last buffer depends on the file’s remaining size.

![Image 19: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/3d987b2603fbb0a2c39e222106b5000b.png)

The result is shown below:

![Image 20: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/754fc5fa981ebc2355bd9f5827ce5d47.png)

At the end of execution, it reboots the system using the _ExitWindowsEx()_ call.

![Image 21: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/88e9014170f32eefaca2e2d068c210b8.png)

## Conclusion

The Sandworm APT group continues to develop disruptive malware and deploy it on different networks. Their new SwiftSlicer malware wipes all users’ files on the system, as well as system files such as drivers.

The whole corruption process was not particularly fast, because SwiftSlicer has only one thread, which enumerates files, loads and overwrites them. As a result, the process can be spotted early, before it corrupts the System drive.

Still, without good cybersecurity tools, some files could be corrupted and lost even if the malware was spotted and its execution terminated, as SwiftSlicer deletes all shadow copies at the start of execution.

## Detected by Acronis

![Image 22: SwiftSlicer: A simple yet dangerous data wiper](https://staticfiles.acronis.com/images/content/566a0539670b75af01fca38a6fa79f12.png)

## IoCs

### Files

SHA256

1db93ee81050da0ba413543f9fbc388499a466792f9a54ea6f1bbdb712ba9690

Related articles

[The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/)  
[Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/)  
[Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/)  
[AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)