No key to buy: WhisperGate and the agency recovery plan

The week

On January 13 and 14, 2022, dozens of Ukrainian government websites were defaced. On January 15, Microsoft disclosed that it had found destructive malware on systems at multiple Ukrainian government agencies and organizations. The malware, later widely called WhisperGate, displayed a ransom note but overwrote the disk’s master boot record and corrupted files, with no mechanism for recovery. On January 18, CISA published guidance urging US organizations to take immediate steps to reduce the likelihood and impact of a potentially damaging intrusion, including planning for destructive attacks and testing backups. A week earlier, on January 11, CISA, the FBI and the NSA had issued a joint advisory on Russian state-sponsored threats to US critical infrastructure. Russian forces were then massing on Ukraine’s borders.

Ransomware had shaped how US public agencies imagined a worst-case cyber event. Ransomware is extortion. Its operators want to be paid, so they keep a way to restore data. However distasteful, payment sits somewhere in the decision tree, and many continuity plans assumed, without saying so, that it could be the final fallback. WhisperGate borrowed ransomware’s look without its economics. The note was a disguise, and there was no key for sale. For a state agency, a county or a city, a wiper turns every recovery assumption into a test of the agency’s own backups and rebuild capability. We look at three stages where the difference bites: telling a wiper from ransomware, containing it, and rebuilding from nothing.

Telling a wiper from ransomware

A destructive attack dressed as ransomware is built to waste the first hours. The note invites the victim to contact the attacker, open a negotiation and wait. Meanwhile, the damage completes. Incident response playbooks that branch on “is this ransomware?” can send the team down the wrong path if they accept the note at face value.

Classification should rest on evidence, not on what the malware says about itself. Early questions include whether the boot record or disk structures have been overwritten, whether files are encrypted with a recoverable scheme or simply corrupted, and whether the sample matches known destructive families. Those answers take forensic skill. Most small and mid-sized agencies do not have it in-house. The practical control is a pre-arranged incident response retainer that can put an analyst on the problem within hours, whether through the state, a cooperative contract or an insurer. Many states had begun offering such services to localities, and those arrangements were worth confirming that month.

Classification also changes who gets called. A suspected state-sponsored wiper during an international crisis is a national security matter as well as a local outage. Agencies need to know in advance how to reach CISA and the FBI, and for state and local governments, the state fusion center and emergency management agency. Those contacts work far better when they already know the agency’s name.

Containing something that wants no ransom

Ransomware operators often spend weeks in a network before encrypting, because they want the strongest possible hand in a negotiation. A wiper deployed for disruption may act faster and with less discrimination. Containment therefore depends on decisions made in the first hour, and on design choices made long before.

The first-hour decision is authority. Someone must be able to order networks disconnected, VPN access cut and domain controllers isolated, at night and on weekends, without convening a committee. In many local governments that authority was unclear, split between an IT director, a county administrator and elected officials. Writing down who decides, and their deputies, is cheap.

The design choices are segmentation and privileged access. A wiper that reaches domain administrator credentials can push itself to every joined machine through ordinary administrative tools. Separating administrative accounts for servers, workstations and identity systems, and limiting which hosts can reach which, decides whether a wiper takes one department or the whole jurisdiction. Agencies that share a domain across police, courts, public works and finance have the widest exposure, because one compromise reaches all of them.

Rebuilding from nothing

With a wiper, recovery means restoring from backups and rebuilding what cannot be restored. Several questions decide how long that takes. Are the backups isolated, so that credentials in the production directory cannot delete or encrypt them? Have restores been tested at scale, or only for single files and single servers? Can the agency rebuild its directory service, since nothing else authenticates without it? Which public services come back first, and who decided?

Many agencies had never restored their full environment and did not know their real recovery time. A plan that says “restore from backup” hides a sequence: rebuild identity, restore core infrastructure, restore applications in priority order, reimage endpoints, and reissue credentials. Each step has dependencies and staffing limits. Run end to end, the sequence often takes weeks, not days, in organizations that have only tested pieces of it.

The most useful exercise is a recovery test that assumes total loss of the primary environment, identity included, and measures time to restore a short list of critical public services. Typical candidates are 911 and dispatch support systems, payroll, benefits payments and permitting. The exercise usually exposes single points of failure, such as one data center, one backup administrator or one vendor-hosted system with no export. It also produces a number that budget committees understand.

Communication belongs in the rebuild plan. If the agency’s website, email and phone system are gone, residents still need to know which services are available and where to go. Pre-arranged alternatives, such as a page hosted by the state, social media accounts with recovery codes stored offline, and printed contact lists, let an agency speak while it rebuilds.

With hindsight

WhisperGate was the first of several destructive malware families used against Ukraine in 2022. HermeticWiper appeared the day before the February 24 invasion, and an attack on a satellite communications network that day disrupted users across Europe. Widespread destructive attacks on US agencies did not follow. Ransomware against local governments continued, and pro-Russian hacktivists and Iranian-linked actors later tampered with poorly secured water utility controls in the US. The more durable effect was on recovery practice. Isolated or immutable backups and restore tests became standard questions from cyber insurers and state oversight bodies. CISA’s free services and state-run shared programs extended forensic support to small jurisdictions. By this point in 2026, agencies that have run a total-loss recovery test know their real restore times. Those that have not are still relying on an assumption WhisperGate showed was unsafe.