ETDA สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency
Report
Search
Home > List all groups > List all tools > List all groups using tool CaddyWiper

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: CaddyWiper

NamesCaddyWiper
CategoryMalware
TypeWiper
Description(ESET) ESET researchers have uncovered yet another destructive data wiper that was used in attacks against organizations in Ukraine.
Dubbed CaddyWiper by ESET analysts, the malware was first detected at 11.38 a.m. local time (9.38 a.m. UTC) on Monday. The wiper, which destroys user data and partition information from attached drives, was spotted on several dozen systems in a limited number of organizations. It is detected by ESET products as Win32/KillDisk.NCX.
CaddyWiper bears no major code similarities to either HermeticWiper or IsaacWiper, the other two new data wipers that have struck organizations in Ukraine since February 23rd.
Much like with HermeticWiper, however, there’s evidence to suggest that the bad actors behind CaddyWiper infiltrated the target’s network before unleashing the wiper.
Information<https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/>
<https://blog.talosintelligence.com/2022/03/threat-advisory-caddywiper.html>
<https://blog.malwarebytes.com/threat-intelligence/2022/03/double-header-isaacwiper-and-caddywiper/>
<https://blog.morphisec.com/caddywiper-analysis-new-malware-attacking-ukraine>
<https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/>
<https://therecord.media/a-deeper-look-at-the-malware-being-used-on-ukrainian-targets/>
<https://cybersecurity.att.com/blogs/labs-research/analysis-on-recent-wiper-attacks-examples-and-how-they-wiper-malware-works>

Last change to this tool card: 03 May 2022

Download this tool card in JSON format

All groups using tool CaddyWiper

ChangedNameCountryObserved

APT groups

XSandworm Team, Iron Viking, Voodoo BearRussia2009-Jun 2022 HOTX

1 group listed (1 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1227
E-mail [email protected]