CaddyWiper
Essential information
- Confidence
- 100/100
- Is family
- Yes
- Published
- 23/03/2022 21:15
- Modified
- 27/03/2026 01:06
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Related entities
- 17 attack patterns (mitre), 2 intrusion sets (apt), 3 sectors, 1 countries, 19 indicators, 1 campaign, 1 campaigns
Description
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.
Attack patterns (MITRE) (17)
-
T1072 usesSoftware Deployment Tools MITRE
-
T1082 usesSystem Information Discovery MITRE
-
T1561.002 usesDisk Structure Wipe MITRE
-
T1059 usesCommand and Scripting Interpreter MITRE
-
T1566 usesPhishing MITRE
-
T1572 usesProtocol Tunneling MITRE
-
T1057 usesProcess Discovery MITRE
-
T1485 usesData Destruction MITRE
-
T1484.001 usesGroup Policy Modification MITRE
-
T1222.001 usesWindows File and Directory Permissions Modification MITRE
-
T1543 usesCreate or Modify System Process MITRE
-
T1083 usesFile and Directory Discovery MITRE
Intrusion sets (APT) (2)
-
Sandworm usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation:…
First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (3)
-
Finance targets
-
Energy targets
-
Government targets
Countries (1)
-
Ukraine targets
Indicators (19)
-
stix 100/100 Revoked· Valid until 06/05/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 16/07/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 06/05/2024 · Source: AlienVault
-
5cbad1680babb4e71c75ed3259857e29dd1edb1cindicatesyara 100/100 RevokedSearching for REGEORG webshells.
· Valid until 11/02/2025 · Source: AlienVault -
stix 100/100 Revoked· Valid until 16/07/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 06/05/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 16/07/2023 · Source: AlienVault
-
46adb27b4e8823250cbd29f63b695079cccfd326indicatesyara 100/100 RevokedSearching for Systemd Unit Configuration Files but with some known filenames observed with GOGETTER
· Valid until 11/02/2025 · Source: AlienVault -
stix 100/100 Revoked· Valid until 06/05/2024 · Source: AlienVault
-
5e930d9f5b2b8943f02206a15efa9b9491cee995indicatesyara 100/100 RevokedSearching for VBS files used to launch a batch script.
· Valid until 11/02/2025 · Source: AlienVault -
50c0bae4b9e827afb0e888c481fe3b091d7003f7indicatesyara 100/100 RevokedSearching for files containing references to MicroSCADA filesystem path containing native MicroSCADA binaries and resources.
· Valid until 11/02/2025 · Source: AlienVault -
stix 100/100 Revoked· Valid until 16/07/2023 · Source: AlienVault
Campaign (1)
-
2022 Ukraine Electric Power Attack uses
Campaigns (1)
-
2022 Ukraine Electric Power Attack