Loading story…
Destructive malware operations against organizations in Ukraine included CaddyWiper and a separate pseudo-ransomware campaign that posed as extortion but was built to permanently destroy data. Researchers said CaddyWiper shared no code with earlier payloads such as HermeticWiper, but it similarly targeted user files, mapped drives, and disk partitions while avoiding execution on primary domain controllers through a domain-controller kill switch. U.S. authorities warned that multiple malware families were being used in coordinated attacks on Ukrainian networks, underscoring the risk of disruptive and irreversible data loss.
Technical analysis showed the attacks relied on enterprise compromise and staged payload delivery rather than simple smash-and-grab deployment. CaddyWiper checked domain-controller status via the DsRolePrimaryDomainInformation API and wiped disks using low-level Windows functions, while defenders observed destructive payloads being pushed at scale through compromised Group Policy Objects after attackers obtained domain administrator access. In the pseudo-ransomware case, the intrusion chain used an MBR wiper, a downloader retrieving payloads from Discord CDN, a .NET loader that disabled Microsoft Defender and used process hollowing, and a final C-based wiper that overwrote files across 191 extensions before shutting systems down, leaving victims with no practical recovery path despite the ransom note.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Truesec published an analysis of the CaddyWiper wiper used against targets in Ukraine and released a YARA rule named caddy_wiper for detection. The report described the malware's domain-controller check, file and raw-disk destruction behavior, and noted the analyzed sample was compiled on March 14, 2022.
IBM Security X-Force published the XFTI_CaddyWiper YARA rule to detect the CaddyWiper malware family. The rule metadata includes a creation date of 15 March 22 and references a sample named caddy.exe with its SHA-256 hash.
The first reported samples and indicators from a destructive malware campaign targeting Ukraine appeared late in the evening UTC on January 13, 2022. Trellix later assessed the operation as pseudo-ransomware because its final payload irreversibly destroyed data rather than enabling recovery.
Splunk published the "Ransomware Investigate and Contain" response playbook for investigating and containing ransomware on endpoints. The playbook lists required SOAR integrations including Palo Alto Networks Firewall, WildFire, LDAP, and Carbon Black Response.
CISA published an updated alert titled "Destructive Malware Targeting Organizations in Ukraine." The reference indicates an official U.S. government update on the malware threat affecting Ukrainian organizations.
Splunk published a threat update stating that ESET had recently discovered the destructive malware payload CaddyWiper in malicious cyber activity targeting Ukraine. The report said CaddyWiper shared no code with earlier payloads such as HermeticWiper and described its domain-controller kill switch and GPO-based deployment context.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
trellix.com
Open sourcecisa.gov
Open sourcesplunk.com
Open sourceesentire.com
Open sourcetruesec.com
Open sourcesecurityaffairs.co
Open sourcewelivesecurity.com
Open sourcesecurityintelligence.com
Open sourceresearch.splunk.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple destructive malware campaigns struck Ukraine around the start of Russia’s invasion, with **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, **WhisperGate**, and **DoubleZero** used against government, financial, and other organizations. Researchers reported that HermeticWiper corrupted boot records and partition data by abusing a legitimate EaseUS driver, while CaddyWiper and DoubleZero erased user data, partition information, and critical registry or boot components, often while deliberately sparing domain controllers to preserve attacker access. Several incidents appeared to follow prior compromise of victim networks, including abuse of **Active Directory**, scheduled execution, and in some cases worm-like spread via **HermeticWizard**; HermeticRansom was also deployed as a likely decoy alongside destructive activity. The destructive operations extended beyond enterprise Windows environments. **AcidRain** was used in the attack on Viasat’s **KA-SAT** network, wiping satellite modems in Ukraine and elsewhere in Europe by recursively destroying filesystems and storage devices, while the **Industroyer2** operation targeted a Ukrainian energy provider with malware built to communicate over **IEC-104** and cut power, paired with Windows, Linux, and Solaris wipers including **CaddyWiper**, **ORCSHRED**, **SOLOSHRED**, and **AWFULSHRED**. Across the reporting, defenders were urged to watch for mass file overwrites, shadow copy and event log deletion, MBR or partition changes, suspicious use of administrative tooling and group policy, and to maintain tested, isolated backups to recover from destructive attacks.
Aug 15, 2026
Researchers detailed multiple destructive malware families used against Ukrainian targets, linking **AcidRain**, **AcidPour**, and **CaddyWiper** to attacks designed to disable systems and erase data during Russia’s war against Ukraine. Trellix reported that AcidRain was used to disrupt Viasat **KA-SAT** satellite modems, while the newer Linux wiper **AcidPour** adds features including self-overwrite, a configurable execution delay, and recursive wiping of `/boot`. The firm assessed with medium confidence that AcidPour was derived from or closely modeled on AcidRain, and said the activity broadly aligns with a pro-Russian actor, though it did not attribute the attacks to a specific group. On the Windows side, Morphisec said **CaddyWiper** struck several dozen systems in a limited number of Ukrainian organizations and was likely deployed through **Group Policy Object**, indicating prior compromise of an **Active Directory** server. The malware was built to destroy user files and attached drives, and when executed with administrative privileges it also corrupts physical drive partition information, leaving the operating system unusable. Researchers noted that CaddyWiper selectively avoids damaging non-domain-controller systems and dynamically resolves Windows APIs through the **PEB** to hinder detection, placing it among a broader run of wipers including **WhisperGate**, **HermeticWiper**, and **IsaacWiper**.
Aug 14, 2026
Ukraine said Russia-linked threat groups intensified cyberattacks against its critical infrastructure, government, communications, energy, and humanitarian logistics networks, using phishing and multiple destructive malware families including **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, and **DoubleZero**. CERT-UA attributed activity during the period to several tracked clusters such as `UAC-0056`, `UAC-0051/UNC1151`, `UAC-0028/APT28`, and `UAC-0033/XDSpy`, and said the operations were tied to actors affiliated with Russian and Belarusian state structures and proxy entities. Ukrainian officials also reported targeting of organizations documenting war crimes and of European charities supporting refugees, underscoring that the campaign extended beyond domestic wartime targets. Researchers separately documented destructive intrusions in which **HermeticWiper** and **CaddyWiper** were deployed through Windows Group Policy after attackers had already gained broad control of victim networks. HermeticWiper hit finance organizations, government contractors, and other Ukrainian systems while also affecting some machines in Latvia and Lithuania; it corrupted local data and the master boot record, leaving devices unable to boot. In parallel, CERT-UA warned that phishing emails posing as antivirus updates delivered **Cobalt Strike** along with the **GraphSteel** and **GrimPlant** backdoors, a campaign linked with medium confidence to `UAC-0056`, showing that espionage, access operations, and destructive attacks were being conducted in tandem.
Aug 15, 2026