1. Home
  2. Software
  3. CaddyWiper

CaddyWiper

CaddyWiper is a destructive data wiper that has been used in attacks against organizations in Ukraine since at least March 2022.[1][2]

ID: S0693
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 23 March 2022
Last Modified: 17 April 2024
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1485 数据销毁

CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files.[1][2]
Enterprise T1083 文件和目录发现

CaddyWiper can enumerate all files and directories on a compromised host.[3]
Enterprise T1222 .001 文件和目录权限修改: Windows File and Directory Permissions Modification

CaddyWiper can modify ACL entries to take ownership of files.[2]
Enterprise T1106 本机API

CaddyWiper has the ability to dynamically resolve and use APIs, including SeTakeOwnershipPrivilege.[2]
Enterprise T1561 .002 磁盘擦除: Disk Structure Wipe

CaddyWiper has the ability to destroy information about a physical drive's partitions including the MBR, GPT, and partition entries.[1][2]
Enterprise T1082 系统信息发现

CaddyWiper can use DsRoleGetPrimaryDomainInformation to determine the role of the infected machine. CaddyWiper can also halt execution if the compromised host is identified as a domain controller.[2][3]
Enterprise T1057 进程发现

CaddyWiper can obtain a list of current processes.[3]

Groups That Use This Software

ID Name References
G0034 Sandworm Team

[4][5]

Campaigns

ID Name Description
C0034 2022 Ukraine Electric Power Attack

[4]

References

  1. ESET. (2022, March 15). CaddyWiper: New wiper malware discovered in Ukraine. Retrieved March 23, 2022.
  2. Malhotra, A. (2022, March 15). Threat Advisory: CaddyWiper. Retrieved March 23, 2022.
  3. Threat Intelligence Team. (2022, March 18). Double header: IsaacWiper and CaddyWiper . Retrieved April 11, 2022.
  1. Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.
  2. Dragos, Inc.. (2023, December 11). ELECTRUM Targeted Ukrainian Electric Entity Using Custom Tools and CaddyWiper Malware, October 2022. Retrieved March 28, 2024.