NIKOWIPERNikoWiper

NikoWiper is a data wiper reported by ESET in January 2023, used by Sandworm in October 2022 against an energy company in Ukraine, around the time of Russian missile strikes on Ukrainian energy infrastructure. ESET describes it as based on the Microsoft Sysinternals SDelete secure-deletion utility. ESET also saw Sandworm experimenting with SDelete as a wiper in other incidents, such as the attack on the Ukrinform news agency reported by CERT-UA, but told The Hacker News that NikoWiper is a distinct malware rather than SDelete itself. In October 2026, ESET documented another SDelete-based wiping operation by Sandworm, deployed through Active Directory Group Policy against a Ukrainian grain logistics company after initial access by UAC-0099.