CaddyWiper
CaddyWiper is a destructive wiper malware for Windows, first publicly identified in March 2022 and detected by ESET as Win32/KillDisk.NCX. It has been used in destructive operations against Ukrainian organizations during Russia’s invasion of Ukraine, including Ukrainian banks, government entities, the news agency Ukrinform, and a Ukrainian energy provider. Multiple sources in the content associate its use with the Russia-linked Sandworm threat group (GRU Unit 74455), including during the 2022 Ukraine Electric Power Attack.
Its core behavior is destructive file and disk wiping. Reported capabilities include overwriting user files, mapped drives, file content, physical drive partitions, and partition metadata with null bytes, rendering systems unbootable or difficult to recover. The malware has been described as destroying partition information including the MBR, GPT, partition entries, and boot partitions. ESET and Mandiant reporting in the content state that it enumerates physical drives and overwrites both file content and partitions with null bytes.
The content also states that CaddyWiper contains logic to detect whether it is running on a Domain Controller and, if so, trigger a killswitch rather than execute destructively. If not on a Domain Controller, it proceeds to destroy user data and mapped drives.
Observed deployment methods include execution via Scheduled Tasks and Group Policy Objects (GPOs). During the 2022 Ukraine Electric Power Attack, Sandworm used Scheduled Tasks through a GPO to execute CaddyWiper at a predetermined time. In the April 2022 Ukrainian energy-sector incident, CaddyWiper was scheduled shortly after Industroyer2 to erase traces and hinder recovery. The content also notes a deployment using a loader named ARGUEPATCH, identified as a patched Hex-Rays IDA Pro remote debugger server, to decrypt and run CaddyWiper. Mandiant reporting cited in the content further describes GRU-linked UNC3810 using modified GPOs and a tool called TANKTRAP to deploy CADDYWIPER variants across a Windows domain via scheduled tasks.
The malware is part of a broader cluster of Russia-linked destructive tooling used against Ukraine, alongside HermeticWiper, WhisperGate, Industroyer2, IsaacWiper, DoubleZero, AwfulShred, Orcshred, and Soloshred. The content indicates multiple CaddyWiper variants have been observed over time, including x64, x86, and shellcode variants, and that it has been deployed in conjunction with OT-disruptive activity and other wipers to impede recovery in critical infrastructure environments.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
"...виявлено 5 зразків шкідливих програм (скриптів)... а саме: CaddyWiper (Windows) ..."; "...невдалу спробу... з використанням шкідливих програм-деструкторів CaddyWiper..."
"CADDYWIPER is a wiper that Mandiant first identified and reported on in March 2022... The malware enumerates the file system's physical drives and overwrites both file content and partitions with null bytes."
"CADDYWIPER is a wiper that Mandiant first identified and reported on in March 2022... The malware enumerates the file system's physical drives and overwrites both file content and partitions with null bytes."
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
3 techniques"...створено об'єкт групової політики (GPO), що, у свою чергу, забезпечував створення відповідних запланованих завдань." and "Windows_Security_Update_HxW (Scheduled Task)"
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Persistence
2 techniques"...створено об'єкт групової політики (GPO), що, у свою чергу, забезпечував створення відповідних запланованих завдань." and "Windows_Security_Update_HxW (Scheduled Task)"
Privilege Escalation
3 techniques"...створено об'єкт групової політики (GPO), що, у свою чергу, забезпечував створення відповідних запланованих завдань." and "Windows_Security_Update_HxW (Scheduled Task)"
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Stealth
1 techniqueThe content includes multiple anti-analysis and environment checks, such as "OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks" and "Raspberry Robin performs several system checks as part of anti-analysis mechanisms."
Defense Impairment
2 techniquesDiscovery
5 techniquesThe content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
“3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory… admin@338 actors used… dir c:\ >> %temp%\download … APT28 has used Forfiles to locate PDF, Excel, and Word documents…”
"CaddyWiper can use DsRoleGetPrimaryDomainInformation to determine the role of the infected machine. CaddyWiper can also halt execution if the compromised host is identified as a domain controller."
The content includes multiple anti-analysis and environment checks, such as "OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks" and "Raspberry Robin performs several system checks as part of anti-analysis mechanisms."
Lateral Movement
1 techniqueDuring the 2022 Ukraine Electric Power Attack, Sandworm Team used a Group Policy Object (GPO) to copy CaddyWiper's executable msserver.exe from a staging server to a local hard drive before deployment.
Command and Control
1 technique"...з метою централізованого розповсюдження шкідливих програм, створено об'єкт групової політики (GPO)..." and paths under "\\%DOMAIN%\\SYSVOL...\\news.bat" / "upd.exe"
Impact
5 techniquesThe hackers also deployed multiple forms of 'wiper' malware designed to destroy data on computers within the utility.
"GRU operations... frequently end with the deployment of wipers... CADDYWIPER... overwrites both file content and partitions with null bytes."
“AcidPour can identify various system locations and mapped devices on Linux systems as a precursor to wiping activity.”
APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR). APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable. CaddyWiper has the ability to destroy information about a physical drive's partitions including the MBR, GPT, and partition entries.
Other
1 techniqueRecent activity
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Wiper malware used against Ukrainian infrastructure as part of Sandworm-attributed campaigns.
Destructive wiper malware previously deployed against Ukrainian networks, including power-supply units.
Data-wiping malware variants used in Sandworm-linked operations impacting Ukraine’s power grid.
Destructive wiper used in attacks (noted in 2022 activity).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.