# What is wiper malware?

Wiper malware destroys data instead of holding it for ransom: it overwrites files, disk structures or firmware so that systems cannot start or data cannot be recovered. It is used for sabotage, sometimes disguised as ransomware with a ransom note that leads nowhere, and companies can be hit as collateral damage when it spreads through shared suppliers or networks. Because there is nothing to negotiate, offline backups and a tested recovery plan are the only real answer. The steps before wiping are similar to other intrusions: access, command and control, movement to many machines, sometimes through central management tools that push the wiper everywhere at once. NetSenX does not detect the wiping itself, which happens on hosts; it watches the earlier steps, such as beaconing, scanning and lateral movement, on every plan.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-wiper-malware

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is cryptojacking, and can we see it on the network?](https://netsenx.com/en/faq/what-is-cryptojacking)
- [What is lateral movement in cybersecurity?](https://netsenx.com/en/faq/what-is-lateral-movement-in-cybersecurity)
- [How do you detect C2 beaconing?](https://netsenx.com/en/faq/how-do-you-detect-c2-beaconing)
- [Can you detect lateral movement in encrypted traffic?](https://netsenx.com/en/faq/can-you-detect-lateral-movement-in-encrypted-traffic)
- [Which MITRE ATT&CK techniques can network detection see?](https://netsenx.com/en/faq/which-mitre-att-ck-techniques-can-network-detection-see)