Loading malware…
ArguePatch is a malware loader associated with Sandworm (Russia’s GRU-linked Unit 74455, also tracked as APT44/Seashell Blizzard) and used in attacks against targets in Ukraine in 2022. Public reporting from ESET and CERT-UA describes it as a modified legitimate binary used to decrypt and execute payloads, including as a trojanized Hex-Rays IDA Pro remote debugger server (win32_remote.exe) that loaded encrypted shellcode to run CaddyWiper. In other observed cases, ESET reported ArguePatch taking the form of a modified ESET binary. ArguePatch was used in destructive operations alongside CaddyWiper, including the April 8, 2022 attack on a Ukrainian energy provider during Sandworm’s attempted Industroyer2-enabled power disruption, where CaddyWiper was scheduled shortly after Industroyer2 to erase traces. ESET also reported ArguePatch and CaddyWiper deployments against Ukrainian institutions on April 1, 2022, during the week starting June 20, 2022, and again on June 23, 2022. High-confidence context links ArguePatch to Sandworm’s broader destructive activity in Ukraine, particularly campaigns targeting Ukrainian organizations and the energy sector. The provided content does not include standalone IoCs specific to ArguePatch beyond the trojanized win32_remote.exe artifact and its role as a loader for encrypted shellcode/CaddyWiper.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ESET. Sandworm uses a new version of ArguePatch to attack targets in Ukraine. Published: May 20, 2022.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader malware used by Sandworm in Ukraine to support intrusion activity and payload delivery.
Shellcode loader (often a modified legitimate binary) used to load external shellcode; observed delivering CaddyWiper in Sandworm operations.
Destructive malware family referenced as part of Sandworm-attributed destructive operations.
GRU: Rise of the (Telegram) MinIOns ArguePatch CaddyWiper XakNet
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.