Loading malware…
CaddyWiper is a destructive Windows wiper used in attacks against Ukrainian organizations during the 2022 Russia-Ukraine war. It was first publicly identified in March 2022 and is widely associated with Russian state-aligned intrusion activity targeting government, financial, and critical infrastructure environments. Reporting also links its deployment in some operations to clusters tracked as UAC-0082, and later use against organizations involved in power generation, water supply, and transportation was attributed by Microsoft to IRIDIUM, also known as Sandworm.
The malware is designed to render systems unusable by overwriting user data and damaging disk partition information on attached drives. On non-domain-controller systems, it recursively wipes files in user-accessible locations and across additional mounted drives, including mapped network drives, then attempts to corrupt physical drive layout information, including partition structures. Analyses describe a two-stage destructive routine: file overwriting followed by destruction of disk layout metadata. CaddyWiper uses stack strings for obfuscation and has been observed in closely related variants with only minor assembly-level differences and no meaningful behavioral change.
A distinctive feature of CaddyWiper is that it checks whether the infected machine is a Windows Domain Controller and exits without executing its wiping routine if one is detected. This behavior is assessed as an operational choice to preserve attacker access to Active Directory infrastructure while disrupting the rest of the environment, enabling continued credential access, lateral movement, or broader domain-wide deployment. Multiple reports indicate the malware was deployed through Group Policy Objects or Default Domain Policy, implying the attackers had already compromised the victim’s Active Directory environment before launching the wiper.
CaddyWiper does not show significant code similarity to HermeticWiper or IsaacWiper despite appearing in the same broader campaign environment. It is generally characterized as a relatively simple but effective sabotage tool intended for disruption rather than financial extortion. Its use alongside other destructive payloads in Ukraine, and in some cases in conjunction with attacks on operational and critical infrastructure, places it within the broader pattern of wartime cyber sabotage conducted in support of Russian military objectives.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
2022-03-15 ⋅ ESET Research ⋅ CaddyWiper: New wiper malware discovered in Ukraine
2022-03-15 ⋅ ESET Research ⋅ CaddyWiper: New wiper malware discovered in Ukraine
Slovak cybersecurity company ESET dubbed the third wiper "CaddyWiper," which it said it first observed on March 14 around 9:38 a.m. UTC.
Notable attacks included the deployment of Industroyer2 against energy facilities and widespread use of CaddyWiper malware.
"CADDYWIPER is a wiper that Mandiant first identified and reported on in March 2022... The malware enumerates the file system's physical drives and overwrites both file content and partitions with null bytes."
"CADDYWIPER is a wiper that Mandiant first identified and reported on in March 2022... The malware enumerates the file system's physical drives and overwrites both file content and partitions with null bytes."
17 distinct techniques documented for this family, organized by ATT&CK tactic.
To obfuscate strings, one can create a string on the stack, character for character, or in small groups of characters. The concatenation of these characters lead to the existence of the complete string on the stack.
Caddy uses the process environment block (PEB) to resolve the required Windows application programming interface (API). This is to evade static and dynamic scanners.
The wiper enumerates through the files, takes ownership of the files overrides File Permissions with SeTakeOwnershipPrivilege and AdjustTokenPrivileges APIs and overwrites 10485760 bytes of data with zeroes.
Similarly to HermeticWiper deployments, we observed CaddyWiper being deployed via GPO, indicating the attackers had prior control of the target's network beforehand.
The wiper checks if the infected machine is a Domain Controller via the DsRoleGetPrimaryDomainInformation API.
The content includes environment-aware checks such as "Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found," "CaddyWiper can also halt execution if the compromised host is identified as a domain controller," and "OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks."
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, enumerating PIDs, checking for specific process names, or using APIs such as CreateToolhelp32Snapshot and commands such as tasklist and ps.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
If the infected machine is not a Domain Controller, the malware recursively wipes the files in C:\Users and D:\ directories. Additionally, CaddyWiper attempts to wipe the files in the driver letters alphabetically starting from D:\ drive until it reaches Z:\ drive.
"CaddyWiper will also attempt to wipe any network mapped drive attached to the system."
CaddyWiper being deployed via GPO, a circumstance that suggests the attackers had initially compromised the target’s Active Directory server.
The wiper checks if the infected machine is a Domain Controller via the DsRoleGetPrimaryDomainInformation API.
The content includes environment-aware checks such as "Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found," "CaddyWiper can also halt execution if the compromised host is identified as a domain controller," and "OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks."
Many entries concern “CaddyWiper”, “new data wiper hits Ukraine”, “destructive wiper malware”, and Sandworm operations using CADDYWIPER alongside INDUSTROYER2.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
67 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Destructive data wiper deployed against Ukrainian organizations and sometimes used alongside INDUSTROYER2.
Destructive wiper malware previously deployed in attacks tied to Ukrainian blackouts.
Wiper deployed in the IT environment alongside Sandworm OT disruption activity in Ukraine.
A destructive wiper used in two closely related versions; both overwrite targeted files, with the article noting zeroing of the first 10 megabytes of targeted files.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.