CoViper

Last reviewed: October 5, 2026

CoViper is a malicious software, or malware, that emerged during the COVID-19 pandemic. It is designed to overwrite the Master Boot Record (MBR) of infected systems, rendering them inoperable. CoViper is a type of destructive malware, which means its primary function is to damage or destroy data on the infected device. As of October 2023, CoViper has been primarily observed targeting systems in Europe and the Middle East. The malware is notable for its use of pandemic-themed lures to trick users into executing it, leveraging the widespread concern and confusion surrounding COVID-19.

Overview

CoViper is a destructive malware that overwrites the Master Boot Record (MBR) of a computer, effectively rendering the system unbootable. The MBR is a critical part of the system's hard drive that contains information on how the operating system is loaded. By targeting the MBR, CoViper prevents the operating system from starting, to data loss and system downtime. The malware gained attention due to its thematic connection to the COVID-19 pandemic, using pandemic-related topics to entice users into executing the malicious code.

History

CoViper was first identified in early 2020, coinciding with the global spread of COVID-19. Researchers at various cybersecurity firms noticed an increase in malware campaigns exploiting the pandemic as a theme. CoViper was among these, using COVID-19-related lures to distribute itself. The malware primarily targeted organizations in Europe and the Middle East, although its exact origin remains unknown. Cybersecurity organizations have not reached a consensus on the group or individuals responsible for its creation and distribution.

Technical characteristics

CoViper operates by overwriting the Master Boot Record (MBR) of the infected system. The MBR is the first sector of a storage device and is crucial for booting the operating system. By overwriting this section, CoViper prevents the system from booting, effectively rendering it inoperable. The malware is typically delivered as a Windows executable file. Once executed, it replaces the MBR with its own malicious code. This code displays a message related to COVID-19 when the system attempts to boot, further emphasizing its thematic connection to the pandemic.

Infection vector

CoViper is primarily distributed through phishing emails that contain pandemic-related themes. These emails often include attachments or links that, when opened, execute the malware on the victim's system. The use of COVID-19 as a lure is designed to exploit the widespread concern and urgency surrounding the pandemic, increasing the likelihood that recipients will engage with the malicious content. Additionally, CoViper may be distributed through compromised websites or drive-by downloads, where users inadvertently download and execute the malware by visiting infected web pages.

Notable campaigns

As of October 2023, CoViper has been involved in several notable campaigns targeting organizations in Europe and the Middle East. These campaigns often coincide with significant developments in the COVID-19 pandemic, such as the announcement of new variants or vaccination rollouts. The malware's operators use these events to craft convincing phishing lures, increasing the likelihood of successful infection. While specific victim organizations are not publicly named, the campaigns have predominantly targeted sectors such as healthcare, government, and education, which are heavily impacted by the pandemic.

Detection and mitigation

Detecting CoViper involves monitoring for signs of MBR tampering and unusual system behavior. Security software can be configured to alert administrators to changes in the MBR, which may indicate the presence of CoViper. To mitigate the risk of infection, organizations should educate employees about the dangers of phishing emails and the importance of verifying the legitimacy of email attachments and links. Regular backups of critical data can help organizations recover from an attack, as restoring the MBR from a backup can return the system to a functional state. Additionally, maintaining up-to-date security software and applying patches can reduce the likelihood of successful exploitation by CoViper.

CoViper Malware Infection Process

CoViper Malware Timeline

Sources

Cybersecurity**Cybersecurity** refers to the practice of protecting systems, networks, and programs from digital attacks. T
Malware**Malware** is a term used to describe malicious software designed to harm, exploit, or otherwise compromise t
2017 Ukraine ransomware attacksThe 2017 Ukraine ransomware attacks were a series of cyberattacks that primarily targeted Ukrainian infrastruc
2019 Baltimore ransomware attackThe 2019 Baltimore ransomware attack was a significant cyber incident that affected the city's computer system
2024 Change Healthcare ransomware attackAs of October 2023, there is no public record of a "2024 Change Healthcare ransomware attack." Therefore, this
2025 Paraguay ransomware attackThe 2025 Paraguay ransomware attack was a significant cyber incident that targeted various sectors in Paraguay

Categories: Malware

Last updated: October 5, 2026