{
  "source_id": "ms-destructive",
  "source_key": "ms-destructive",
  "title": "Destructive malware targeting Ukrainian organizations",
  "publisher": "Microsoft Security",
  "source_url": "https://www.microsoft.com/en-us/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/",
  "originally_published": "2022-01-16T02:28:30+00:00",
  "most_recently_updated": "2026-08-19T15:57:04+00:00",
  "first_collected": "2026-10-22T18:57:47+00:00",
  "last_successfully_checked": "2026-10-22T18:57:47+00:00",
  "original_content_digest": "af2147d1dd874c7815cfc3cace3ec70d173521e4ea71409f355eb12095ae213b",
  "affected_platform": "Windows / enterprise networks",
  "date_note": "Historical primary incident report; not a new incident.",
  "review_decision": "include",
  "reason_codes": [
    "editor-approved",
    "historical-primary-report-evidence-destruction"
  ],
  "editorial_annotation": "Microsoft reports destructive effects on boot records and file content behind a ransom message. Evidence availability can be affected before collection; corroborate the reported behavior against preserved originals and independent records. This is a historical source, not a new incident alert.",
  "topic": "Evidence availability",
  "evidence_quote_reference": {
    "section": "Opening assessment and Observed actor activity",
    "short_quote": "designed to be destructive",
    "note": "Page displays January 15, 2022; publisher machine-readable publication time is January 16, 2022 in UTC. Updated time is publisher metadata, not a new incident date."
  },
  "editor_reviewed": "2026-10-22",
  "historical": true,
  "related_guide_urls": [],
  "record_version_digest": "01638b463ddd9e1c3c99674fa921ff682808e2786936b147d100103e1455fba4"
}