CaddyWiper

Malware updated 7 months ago (2024-05-04T18:58:28.064Z)

Download STIX

Preview STIX

CaddyWiper is a destructive malware, a type of malicious software designed to exploit and damage computer systems. It was one of several malwares deployed against Ukraine starting in January 2022 by the Russian Advanced Persistent Threat (APT) group, alongside others such as WhisperGate, HermeticWiper, IsaacWiper, and Industroyer 2. These malwares were used in coordinated attacks aimed at disrupting operations and causing extensive data loss. Interestingly, some of these malwares, particularly WhisperGate, impersonated ransomware attacks, providing victims with ransom notes but no decryption keys, resulting in irrecoverable data corruption. The CaddyWiper malware had a unique feature: it checked whether the device it infiltrated was a domain controller. If it was, the malware did not wipe the data. This malware, along with Industroyer 2, was utilized extensively in the attacks on Ukraine's industrial control system network. On March 14th, 2022, an attack using CaddyWiper targeted a Ukrainian bank, marking one of the significant instances of its deployment. Furthermore, CaddyWiper and Industroyer 2 were also used in conjunction with other malwares like AWFULSHRED, SOLOSHRED, and ORCSHRED in attacks on Ukraine’s electrical substations. Despite claims of independence from the GRU (Russian military intelligence), evidence suggests that supposed Russian hacktivist groups have close ties to intelligence services. For instance, a self-proclaimed hacktivist group called CyberArmyofRussia_Reborn boasted about CaddyWiper infecting systems before it had actually encrypted any systems. This premature announcement, coupled with the fact that CaddyWiper was part of a larger suite of malware tools used by Russia-backed state groups, indicates a coordinated effort rather than independent actions by disparate hacktivist groups.

Description last updated: 2024-04-18T15:15:54.747Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
Industroyer is a possible alias for CaddyWiper. Industroyer, also known as CrashOverride, is a potent malware specifically designed to target Industrial Control Systems (ICS) used in electrical substations. It first gained notoriety for its role in the 2016 cyberattack on Ukraine's power grid, which resulted in a six-hour blackout in Kyiv. The ma	4
Nikowiper is a possible alias for CaddyWiper. NikoWiper is a malicious software (malware) identified as a new data wiper attributed to Sandworm, a state-backed hacker group linked with Russia's Main Directorate of the General Staff of the Armed Forces (GRU). This malware, unique in its design compared to other strains, was used in an attack on	3
Unc3810 is a possible alias for CaddyWiper. UNC3810 is a malware identified and tracked by cybersecurity firm Mandiant, notorious for its deployment of CaddyWiper in October 2022. This malicious software is designed to exploit and damage computer systems, often infiltrating via suspicious downloads, emails, or websites. The threat actor, init	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Malware

Wiper

Ics

Ukraine

Ransomware

russian

Eset

Russia

Mandiant

Windows

Apt

Ukrainian

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The HermeticWiper Malware is associated with CaddyWiper. HermeticWiper is a destructive malware that was first disclosed by cybersecurity researchers on February 23, 2022. This malicious software was deployed against organizations in Ukraine, with the intent of destroying computer systems and rendering them inoperable. The malware infiltrates systems thro	has used	4
The Industroyer2 Malware is associated with CaddyWiper. Industroyer2 is a sophisticated piece of malware designed to target Industrial Control Systems (ICS), developed and deployed by the Russian state-sponsored advanced persistent threat group, Sandworm. The group has been active since 2007 and used Industroyer2 in a significant attack against Ukraine's	Unspecified	4
The WhisperGate Malware is associated with CaddyWiper. WhisperGate is a malicious software (malware) deployed by Unit 29155 cyber actors, known for their extensive use of this malware, particularly against Ukraine. The malware corrupts a system's master boot record, displays a fake ransomware note, and encrypts files based on specific file extensions. T	Unspecified	4
The Isaacwiper Malware is associated with CaddyWiper. IsaacWiper is a malicious software (malware) that has been identified as part of a series of cyberattacks against Ukraine in 2022. The malware is known to exploit and damage computer systems, often infiltrating them through suspicious downloads, emails, or websites. Once inside, IsaacWiper can disru	Unspecified	4
The Foxblade Malware is associated with CaddyWiper. Foxblade, also known as HermeticWiper, is a form of malware designed to exploit and damage computer systems. It was first reported in attacks that took place on March 10th, 2022, as part of the Hermetic campaign. The campaign also saw the deployment of another malware called HermeticRansom (or Sonic	Unspecified	2
The Prestige Ransomware Malware is associated with CaddyWiper. In October 2022, a new strain of ransomware known as Prestige was reported by Microsoft. This malware had not been observed by Microsoft prior to its deployment and was found targeting transportation and logistics organizations in Ukraine and Poland. Prestige ransomware infects systems through suspi	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The Sandworm Threat Actor is associated with CaddyWiper. Sandworm, a threat actor linked to Russia, has been identified as the primary cyber attack unit supporting Russian military activities in Ukraine. This group is notorious for its sophisticated and disruptive cyber attacks, including the compromise of 11 Ukrainian telecommunications providers which c	has used	8
The Cyberarmyofrussia_reborn Threat Actor is associated with CaddyWiper. CyberArmyofRussia_Reborn is a threat actor with suspected links to the GRU, Russia's main intelligence agency. This group has been associated with several high-profile cyberattacks, including those on US and Polish water utilities and a French dam. The group uses its Telegram channel to leak stolen	Unspecified	2

Source Document References

Information about the CaddyWiper Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
Securityaffairs	7 months ago	Previously unknown Kapeka backdoor linked to Sandworm APT
DARKReading	8 months ago	Russian APT Releases More Deadly Variant of AcidRain Wiper Malware
CERT-EU	10 months ago	Analysis of OT cyberattacks and malwares
Securityaffairs	a year ago	Russia-linked APT Sandworm was inside Ukraine telecoms giant Kyivstar for months
BankInfoSecurity	a year ago	Ukraine Tracks a Record Number of Cyber Incidents During War
CERT-EU	a year ago	Mandiant tackles destructive Sandworm cyber attack on Ukrainian infrastructure
SecurityIntelligence.com	a year ago	CaddyWiper: Third Wiper Malware Targeting Ukrainian Organizations
CERT-EU	a year ago	Sandworm, a Russian Threat Actor, Disrupted Power in Ukraine Via Cyberattack
CERT-EU	a year ago	Russia’s Sandworm hackers behind power blackouts in Ukraine amid massive missile strikes
CERT-EU	a year ago	How Living-off-the-land (LotL) technique is used to hack into power grids & cause power outages
CERT-EU	a year ago	Ukraine's power grid targeted by Sandworm hackers last year
CERT-EU	a year ago	Russian Hackers Sandworm Cause Power Outage in Ukraine Amidst Missile Strikes
Securityaffairs	a year ago	Russian Sandworm disrupts power in Ukraine with a new OT attack
CERT-EU	a year ago	Sandworm hackers incapacitated Ukrainian power grid amid missile strike - Help Net Security
CERT-EU	a year ago	Russian hackers disrupted Ukrainian electrical grid last year
CERT-EU	a year ago	Russia's Sandworm, not just missile strikes, behind blackout
CERT-EU	a year ago	Russian hackers switch to LOTL technique to cause power outage
InfoSecurity-magazine	a year ago	Russian APT Sandworm Disrupted Power in Ukraine Using OT Techniques
CERT-EU	a year ago	New BiBi-Linux wiper malware targets Israeli orgs in destructive attacks
BankInfoSecurity	a year ago	Ukrainian Telcos Targeted by Suspected Sandworm Hackers