U.S. v. Amin Stigal (GRU Unit 29155 WhisperGate Wiper)
Key Facts
- Legal Status: FUGITIVE in U.S. District Court for the District of Maryland.
- Primary Target Sector: Government & Critical Infrastructure.
- Documented Financial Loss: $50.0 million.
- 2 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Federal criminal indictment charging Russian military intelligence conspirator serving GRU Unit 29155 with unleashing the destructive WhisperGate master boot record wiper malware against Ukrainian civilian ministry systems on the eve of the 2022 invasion and conducting cyber reconnaissance against 26 NATO member state critical infrastructure networks.
Root Cause & Infiltration Vector
Adversary gained initial access via Exploit Public-Facing Application: Conspirators exploited vulnerabilities in content management systems and public-facing web servers to establish foothold before wiper detonation.
Operational Impact & Financial Blast Radius
Resulted in $50,000,000 in documented financial liabilities. Disruption of emergency services and catastrophic data loss across Ukrainian civilian and government agencies.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Conspirators exploited vulnerabilities in content management systems and public-facing web servers to establish foothold before wiper detonation.
WhisperGate executed a multi-component wiper that overwrote the Master Boot Record with a fraudulent ransom note while deploying a secondary payload to destroy user files with zero bytes.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Government & Critical Infrastructure infrastructure.
Federal criminal indictment charging Russian military intelligence conspirator serving GRU Unit 29155 with unleashing the destructive WhisperGate master boot record wiper malware against Ukrainian civilian ministry systems on the eve of the 2022 invasion and conducting cyber reconnaissance against 26 NATO member state critical infrastructure networks.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
WhisperGate wiper detonates across dozens of Ukrainian government ministry systems.
FBI identifies reconnaissance scanning against Maryland state infrastructure and NATO ally systems.
Grand jury in Maryland indicts Amin Stigal; State Department issues $10 million Rewards for Justice bounty.
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1485 | Data Destruction Impact | "WhisperGate executed a multi-component wiper that overwrote the Master Boot Record with a fraudulent ransom note while deploying a secondary payload to destroy user files with zero bytes." | Indictment ¶ 19, Page 6 | reviewed |
| T1190 | Exploit Public-Facing Application Initial Access | "Conspirators exploited vulnerabilities in content management systems and public-facing web servers to establish foothold before wiper detonation." | Indictment ¶ 24, Page 8 | reviewed |