CaddyWiper

CaddyWiper is a destructive malware, a type of malicious software designed to exploit and damage computer systems. It was one of several malwares deployed against Ukraine starting in January 2022 by the Russian Advanced Persistent Threat (APT) group, alongside others such as WhisperGate, HermeticWiper, IsaacWiper, and Industroyer 2. These malwares were used in coordinated attacks aimed at disrupting operations and causing extensive data loss. Interestingly, some of these malwares, particularly WhisperGate, impersonated ransomware attacks, providing victims with ransom notes but no decryption keys, resulting in irrecoverable data corruption. The CaddyWiper malware had a unique feature: it checked whether the device it infiltrated was a domain controller. If it was, the malware did not wipe the data. This malware, along with Industroyer 2, was utilized extensively in the attacks on Ukraine's industrial control system network. On March 14th, 2022, an attack using CaddyWiper targeted a Ukrainian bank, marking one of the significant instances of its deployment. Furthermore, CaddyWiper and Industroyer 2 were also used in conjunction with other malwares like AWFULSHRED, SOLOSHRED, and ORCSHRED in attacks on Ukraine’s electrical substations. Despite claims of independence from the GRU (Russian military intelligence), evidence suggests that supposed Russian hacktivist groups have close ties to intelligence services. For instance, a self-proclaimed hacktivist group called CyberArmyofRussia_Reborn boasted about CaddyWiper infecting systems before it had actually encrypted any systems. This premature announcement, coupled with the fact that CaddyWiper was part of a larger suite of malware tools used by Russia-backed state groups, indicates a coordinated effort rather than independent actions by disparate hacktivist groups.