CaddyWiper
Essential information
- Confidence
- 100/100
- Is family
- Yes
- Published
- 23/03/2022 21:15
- Modified
- 27/03/2026 01:06
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Related entities
- 17 attack patterns (mitre), 2 intrusion sets (apt), 3 sectors, 1 countries, 19 indicators, 1 campaign, 1 campaigns
Description
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.
Attack patterns (MITRE) (17)
-
T1072 usesSoftware Deployment Tools MITRE
-
T1082 usesSystem Information Discovery MITRE
-
T1561.002 usesDisk Structure Wipe MITRE
-
T1059 usesCommand and Scripting Interpreter MITRE
-
T1566 usesPhishing MITRE
-
T1572 usesProtocol Tunneling MITRE
-
T1057 usesProcess Discovery MITRE
-
T1485 usesData Destruction MITRE
-
T1484.001 usesGroup Policy Modification MITRE
-
T1222.001 usesWindows File and Directory Permissions Modification MITRE
-
T1543 usesCreate or Modify System Process MITRE
-
T1083 usesFile and Directory Discovery MITRE
Intrusion sets (APT) (2)
-
Sandworm usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation:…
First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (3)
-
Finance targets
-
Energy targets
-
Government targets
Countries (1)
-
Ukraine targets
Indicators (19)
-
stix 100/100 Revoked
SHA256 of 3cdbc19bc4f12d8d00b81380f7a2504d08074c15
· Valid until 29/05/2024 · Source: AlienVault -
stix 100/100 Revoked
Other:Malware-gen\ [Trj] SHA256 of 9ce1491ce69809f92ae1fe8d4c0783bd1d11fbe7
· Valid until 29/05/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 06/05/2024 · Source: AlienVault
-
692b505a3a5efb4b0b1f0a72e2d8dbebe2afb3d3indicatesyara 100/100 RevokedSearching for files containing strings associated with the MicroSCADA Supervisory Control Implementation Language (SCIL) scilc.exe binary.
· Valid until 11/02/2025 · Source: AlienVault -
stix 100/100 Revoked
Win32:MalwareX-gen\ [Trj] SHA256 of 6fa04992c0624c7aa3ca80da6a30e6de91226a16
· Valid until 29/05/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 06/05/2024 · Source: AlienVault
-
7e5af65d8d248d5bfa71e828a7186cd1cdd0cea3indicatesyara 100/100 RevokedSearching for files containing strings associated with execution of the MicroSCADA Supervisory Control Implementation Language (SCIL) scilc.exe binary.
· Valid until 11/02/2025 · Source: AlienVault
Campaign (1)
-
2022 Ukraine Electric Power Attack uses
Campaigns (1)
-
2022 Ukraine Electric Power Attack