Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Customer testimonials and case studies.
Stories on cyberattacks, customers, employees, and more.
Cyber incident, analyst, and thought leadership reports.
Demonstrations, seminars and presentations on cybersecurity topics.
Information and solution briefs for our services.
MITRE ATT&CK Framework, Cybersecurity Assessment, SOC Calculator & more
First discovered by ESET researchers in March 2022, CaddyWiper malware is a new type of wiper malware used by Russian threat actors to target Ukrainian organizations, and the fourth wiper identified since the invasion of the Ukraine. Unlike ransomware, the only objective of using wiper malware is to damage files, data, hard drives, or entire programs and cause as much destruction as possible in the targeted organization’s endpoints and network.
eSentire’s Threat Intelligence (TI) team assesses with high confidence that as the hybrid war between Russia and Ukraine continues, threat actors will continue developing more destructive malware with the goal to disrupt the operations in Ukrainian infrastructure since the wiping malware does not need to be sophisticated to perform the basic wiping capabilities.
The destructive malware named CaddyWiper was first reported by ESET Researchers on March 14, 2022. The malware was first detected at 11:38 a.m. local time (5:38 a.m. EST) targeting organizations in Ukraine. According to ESET, the infection mechanism is similar to the HermeticWiper malware in that it operates via Default Domain Policy.
eSentire TI has observed 4 CaddyWiper samples targeting Ukrainian organizations in the wild including a UPX packed version. CaddyWiper is the fourth wiper observed targeting Ukrainian organizations since January 2022.
CaddyWiper is a PE32 (32-bit) executable written in C++ programming language with a file size of 9.00 KB (9,216 bytes). The compilation timestamp for all the wiper samples dates to March 14, 2022 (on the same day when the first attacks were observed).
The malware samples do not appear to be digitally signed except for one sample (SHA-256: 1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176). The file is signed by TrustAsia (Exhibit 2).
The wiper uses stackstrings, which is the technique used by malware developers to “conceal” the strings from an analyst (Exhibit 3).
The wiper checks if the infected machine is a Domain Controller via the DsRoleGetPrimaryDomainInformation API. The API gets state data for the computer, which includes the state of the directory service installation and domain data. If the infected machine is not a Domain Controller, the malware recursively wipes the files in C:\Users and D:\ directories. Additionally, CaddyWiper attempts to wipe the files in the driver letters alphabetically starting from D:\ drive until it reaches Z:\ drive (Exhibit 4).
While running the sample on the sandbox machine, the malware did not wipe all the files completely in the mentioned folders, except for shortcut files. The sample also skips wiping the files under C:\ drive.
If the infected machine is the Domain Controller, the wiper will exit (Exhibit 5).
The jump to the function responsible for wiping the files is not taken. Instead, it will exit via the RtlExitUserThread command (Exhibit 6).
The wiper enumerates through the files, takes ownership of the files overrides File Permissions with SeTakeOwnershipPrivilege and AdjustTokenPrivileges APIs and overwrites 10485760 bytes of data with zeroes (Exhibit 7).
After the malware finishes overwriting the files, it uses the DeviceIoControl API with the control code IOCTL_DISK_SET_DRIVE_LAYOUT_EX to access the extended information about the drive's partitions (decrements from Physical Drive 9 to Physical Drive 0). Specifically, it accesses the data on the Master Boot Record (MBR) and GUID Partition Table (GPT) partitions of the hard drives to proceed with the wiping process.
We assess that the wiper sample does not have any similarities with the previous wipers (WhisperGate, HermeticWiper, IsaacWiper) that were used to target Ukrainian organizations. The only distinctive characteristic of CaddyWiper is that it does not target Domain Controllers. We believe it’s probable that this is done to keep the foothold on the Domain Controller to gain access to other machines on the network and that CaddyWiper was developed within one month or less.
Our Threat Response Unit (TRU) combines threat intelligence gleaned from research, security incidents, and the external threat landscape to create actionable outcomes for our customers. We are taking a holistic response approach to combat all malware by deploying countermeasures, such as:
Our detection content is backed by investigation runbooks, ensuring our SOC cyber analysts respond rapidly to any intrusion attempts. In addition, our Threat Response Unit closely monitors the threat landscape and addresses capability gaps and conducts retroactive threat hunts to assess customer impact.
We recommend implementing the following controls to help secure your organization against the CaddyWiper malware:
While the Tactics, Techniques, and Procedures (TTPs) used by adversaries grow in sophistication, they lead to a limited set of choke points at which critical business decisions must be made. Intercepting the various attack paths utilized by the modern threat actor requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions.
eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.
If you’re not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.
Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.
Name | File Hash (SHA-256) |
CaddyWiper | ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72 |
CaddyWiper | a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea |
CaddyWiper | 1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176 |
CaddyWiper (UPX packed) | f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902 |
import "pe" import "hash" import "math" rule CaddyWiper_1: detection CaddyWiper_a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea { condition: for any i in (0..pe.number_of_sections - 1): ( hash.md5(pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) == "f0d4c11521fc3891965534e6c52e128b" and pe.sections[i].name == ".text") and for any i in (0..pe.number_of_sections - 1): ( math.entropy(pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) >= 5 and pe.sections[i].name == ".text") and pe.imports("netapi32.dll", "DsRoleGetPrimaryDomainInformation") and uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 11KB }
rule CaddyWiper: detection CaddyWiper_2 { meta: hash = "f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902" strings: $packer = "UPX0" ascii nocase $packer1 = "UPX1" ascii nocase $packer2 = "UPX2" ascii nocase $function = "DsRoleGetPrimaryDomainInformation" ascii nocase condition: uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and (3 of ($packer*) and $function) and filesize < 26KB }
Our industry-renowned Threat Response Unit (TRU) is an elite team of threat hunters and researchers, that supports our 24/7 Security Operations Centers (SOCs), builds detection models across our Atlas XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. TRU has been recognized for its threat hunting, original research and content development capabilities. TRU is strategically organized into cross-functional groups to protect you against advanced and emerging threats, allowing your organization to gain leading threat intelligence and incredible cybersecurity acumen.