{
  "id": "case-stigal-whispergate-gru",
  "slug": "us-v-stigal-whispergate-gru-29155",
  "title": "U.S. v. Amin Stigal (GRU Unit 29155 WhisperGate Wiper)",
  "summary": "Federal criminal indictment charging Russian military intelligence conspirator serving GRU Unit 29155 with unleashing the destructive WhisperGate master boot record wiper malware against Ukrainian civilian ministry systems on the eve of the 2022 invasion and conducting cyber reconnaissance against 26 NATO member state critical infrastructure networks.",
  "case_number": "1:24-cr-00268",
  "court": "U.S. District Court for the District of Maryland",
  "district": "D. Md.",
  "country": "United States",
  "opened_at": "2024-06-25",
  "status": "fugitive",
  "victim_sector": "Government & Critical Infrastructure",
  "victim_country": "Ukraine",
  "loss_amount_usd": 50000000,
  "loss_amount_note": "Disruption of emergency services and catastrophic data loss across Ukrainian civilian and government agencies.",
  "first_seen_at": "2022-01-13T00:00:00Z",
  "last_updated_at": "2026-10-18T10:00:00Z",
  "actor_slug": "sandworm-team",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1485",
      "evidence_excerpt": "WhisperGate executed a multi-component wiper that overwrote the Master Boot Record with a fraudulent ransom note while deploying a secondary payload to destroy user files with zero bytes.",
      "evidence_locator": "Indictment \u00b6 19, Page 6",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment: U.S. v. Amin Timovich Stigal",
      "source_url": "https://www.justice.gov",
      "technique_name": "Data Destruction",
      "tactic": "Impact"
    },
    {
      "technique_id": "T1190",
      "evidence_excerpt": "Conspirators exploited vulnerabilities in content management systems and public-facing web servers to establish foothold before wiper detonation.",
      "evidence_locator": "Indictment \u00b6 24, Page 8",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment: U.S. v. Amin Timovich Stigal",
      "source_url": "https://www.justice.gov",
      "technique_name": "Exploit Public-Facing Application",
      "tactic": "Initial Access"
    }
  ],
  "events": [
    {
      "event_type": "incident",
      "event_date": "2022-01-13",
      "description": "WhisperGate wiper detonates across dozens of Ukrainian government ministry systems."
    },
    {
      "event_type": "investigation",
      "event_date": "2022-08-01",
      "description": "FBI identifies reconnaissance scanning against Maryland state infrastructure and NATO ally systems."
    },
    {
      "event_type": "indictment",
      "event_date": "2024-06-25",
      "description": "Grand jury in Maryland indicts Amin Stigal; State Department issues $10 million Rewards for Justice bounty."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Adversary gained initial access via Exploit Public-Facing Application: Conspirators exploited vulnerabilities in content management systems and public-facing web servers to establish foothold before wiper detonation.",
    "blast_radius": "Resulted in $50,000,000 in documented financial liabilities. Disruption of emergency services and catastrophic data loss across Ukrainian civilian and government agencies.",
    "kill_chain": [
      {
        "phase": "Phase 1: Initial Access",
        "title": "Initial Perimeter Infiltration",
        "description": "Conspirators exploited vulnerabilities in content management systems and public-facing web servers to establish foothold before wiper detonation.",
        "technical_artifacts": [
          "T1190",
          "Exploit Public-Facing Application"
        ],
        "mitre_technique_id": "T1190"
      },
      {
        "phase": "Phase 2: Impact",
        "title": "Operational Disruption or Extortion Detonation",
        "description": "WhisperGate executed a multi-component wiper that overwrote the Master Boot Record with a fraudulent ransom note while deploying a secondary payload to destroy user files with zero bytes.",
        "technical_artifacts": [
          "T1485",
          "Data Destruction"
        ],
        "mitre_technique_id": "T1485"
      },
      {
        "phase": "Phase 3: Expansion",
        "title": "Internal Traversal & Privilege Escalation",
        "description": "Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Government & Critical Infrastructure infrastructure.",
        "technical_artifacts": [
          "Internal administrative sessions",
          "Network telemetry"
        ],
        "mitre_technique_id": "T1021.002"
      },
      {
        "phase": "Phase 4: Impact",
        "title": "Operational Disruption & Incident Resolution",
        "description": "Federal criminal indictment charging Russian military intelligence conspirator serving GRU Unit 29155 with unleashing the destructive WhisperGate master boot record wiper malware against Ukrainian civilian ministry systems on the eve of the 2022 invasion and conducting cyber reconnaissance against 26 NATO member state critical infrastructure networks.",
        "technical_artifacts": [
          "Incident response logs",
          "Forensic timeline"
        ],
        "mitre_technique_id": "T1078"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across 100% of external and administrative access portals.",
      "Implement network microsegmentation to restrict lateral movement between user workstations and core enclaves.",
      "Maintain immutable, isolated offline backups of mission-critical databases and directory services.",
      "Conduct regular tabletop simulations and verify incident response escalation procedures with legal counsel."
    ]
  }
}