HermeticWiper: Signed-Driver Destruction on the Eve of Invasion

A destructive, worm-assisted wiper operation run from inside an already-compromised Active Directory estate. An operator holding domain-administrator access pushed a binary signed to a code-signing identity to hosts over SMB, ran it as a service, and let it drop and load a legitimately signed EaseUS partition driver to reach the raw disk, overwrite the Master Boot Record, and shred the NTFS Master File Table. The crash-dump facility was disabled to slow forensics, a companion worm re-deployed the payload over SMB and WMI, and a decoy ransom note was dropped to misdirect responders. Reconstruct the destruction chain from SIEM, endpoint XDR, and firewall telemetry, and classify the key ATT&CK techniques.