Article
Inside Void Manticore: Iran’s Hybrid Hacktivist for Information Warfare
Void Manticore profile (STORM-842, Homeland Justice, Karma): hybrid hacktivism and state interests, destructive malware, data leaks and influence work.
Read more
Malware profile
CaddyWiper
Also known as Caddy Wiper
CaddyWiper is destructive malware for Windows that overwrites files and drive structures.
In short
CaddyWiper is destructive malware for Windows that overwrites files and drive structures. CISA says its purpose is to destroy user data so the victim cannot reach it. MITRE says it has been used in attacks on organizations in Ukraine since at least March 2022.
- Names2names in public reportsCaddyWiper · Caddy Wiper
- Techniques7ATT&CK techniques listedDiscovery · Execution · Defense Impairment
- Linked Groups1groups that use itSandworm
In one minute
- What it is
- A destructive data wiper for Windows. MITRE says it has been used against organizations in Ukraine since at least March 2022.
- What it does
- Overwrites files with null bytes, drive by drive, and tries to zero the start of physical drives, which wipes the boot record.
- Who uses it
- CISA's analysis names no actor. MITRE lists Sandworm Team as a user, but only from vendor reports. ENISA (November 2022) lists CaddyWiper among wipers deployed by state-sponsored actors.
- How it gets in
- No government source read says how it first reaches a victim. MITRE says Sandworm Team used Group Policy to copy and run it in one 2022 case.
- What to do first
- Scan with the YARA rule in CISA report AR22-115C, and plan recovery now: keep data backups and a recovery inventory ready, as CISA advises.
What it does
CISA analyzed one sample, a small 32-bit Windows program. It goes through the C:\Users folder first and overwrites the files it can reach with null bytes. It then does the same on other attached drives, starting with D:, and finally tries to zero the first 1920 bytes of physical drives, which wipes the boot record.
CISA's advisory AA22-057A covers CaddyWiper together with HermeticWiper, IsaacWiper and HermeticWizard, and CISA published a separate analysis report for each group. MITRE adds that CaddyWiper can stop if the host is a domain controller.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| CaddyWiper | MITRE ATT&CK software S0693, CISA AA22-057A and AR22-115C, Canadian Cyber Centre bulletin and ENISA Threat Landscape 2022[1, 2, 3, 6, 7] |
| Caddy Wiper | Written this way in the description of CISA report AR22-115C (MAR-10376640-2.v1)[2] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Discovery
Process Discovery T1057
It can get a list of the processes that are running.[1]
System Information Discovery T1082
It can ask Windows for the role of the infected machine, and it can stop if the host is a domain controller.[1]
File and Directory Discovery T1083
It can list all files and directories on the host. CISA saw it enumerate files in C:\Users first.[1, 2]
Execution
Defense Impairment
Impact
Data Destruction T1485
It works through drives in alphabetical order, takes ownership of files and overwrites them.[1, 2]
Disk Wipe: Disk Structure Wipe T1561.002
It can destroy partition information on a physical drive, including the MBR, GPT and partition entries. CISA saw it zero the first 1920 bytes of drives.[1, 2]
How it spreads
MITRE says that in the 2022 Ukraine Electric Power Attack, Sandworm Team used a Group Policy Object (GPO) to copy the CaddyWiper executable from a staging server to a local hard drive before deployment, and used a scheduled task through a GPO to run it at a set time. MITRE bases this on vendor reports. The CISA analysis does not say how the file reaches a victim.
Timeline
- January 2022
- February 26, 2022
- March 2022
Earliest date MITRE gives
MITRE says CaddyWiper has been used in attacks against organizations in Ukraine since at least March 2022.[1]
- 2022-03-23
Date on CISA's detection rule
The YARA rule in CISA report AR22-115C carries this date in its details and says it detects Caddy wiper samples.[2]
- April 28, 2022
- November 2022
ENISA names it
ENISA's Threat Landscape 2022 lists CaddyWiper among wiper families deployed by state-sponsored threat actors.[7]
Who uses it
Detection and defense
Questions
What is CaddyWiper?
MITRE describes it as a destructive data wiper used in attacks against organizations in Ukraine since at least March 2022. CISA's analysis says it overwrites files and the boot record of attached drives with null bytes.
Can data be recovered after an attack?
CISA says the malware makes it impossible for the victim to access the stored data. Its advisory lists data backup files among the resources to have ready for recovery.
Who uses it?
CISA's analysis lists no actor. MITRE lists Sandworm Team as a user, citing vendor reports. ENISA lists CaddyWiper among wipers deployed by state-sponsored actors, and Canada's Cyber Centre lists it among malware used by Russia-linked actors.
Where are the official detection resources?
CISA report AR22-115C (MAR-10376640-2.v1) has a YARA rule and a STIX file. The parent advisory is AA22-057A.
How does it differ from HermeticWiper and IsaacWiper?
CISA's advisory covers them together but points to separate reports: MAR-10375867.r1.v1 for HermeticWiper, MAR-10376640.r1.v1 for IsaacWiper and HermeticWizard, and MAR-10376640.r2.v1 for CaddyWiper.
In our research
- Inside Void Manticore: Iran’s Hybrid Hacktivist for Information Warfare November 2025
- HermeticWiper Malware Technical Analysis Open Report May 2023
- Sandworm Threat group
- Wiper malware Glossary term
Sources
- CaddyWiper, Software S0693 MITRE ATT&CKSupports: Description, platform, techniques, Sandworm Team listed as user.
- MAR-10376640-2.v1 CaddyWiper, AR22-115C CISASupports: Analysis of one sample, behaviour, YARA rule, recommendations, April 28, 2022.
- Update: Destructive Malware Targeting Organizations in Ukraine, AA22-057A CISA and FBISupports: Advisory, CaddyWiper update, report references, mitigations.
- CISA and FBI Update Advisory on Destructive Malware Targeting Organizations in Ukraine CISASupports: Original release February 26, 2022 and the April update.
- Sandworm Team, Group G0034 MITRE ATT&CKSupports: MITRE lists Sandworm Team as using CaddyWiper and describes Group Policy use in 2022.
- Cyber threat bulletin: Cyber threat activity related to the Russian invasion of Ukraine Canadian Centre for Cyber SecuritySupports: CaddyWiper listed among malware used by Russia-linked actors against Ukraine.
- ENISA Threat Landscape 2022 ENISASupports: CaddyWiper listed among wipers deployed by state-sponsored actors, November 2022.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.