Security News > 2022 > March > CaddyWiper: Yet Another Data Wiping Malware Targeting Ukrainian Networks

Two weeks after details emerged about a second data wiper strain delivered in attacks against Ukraine, yet another destructive malware has been detected amid Russia's continuing military invasion of the country.

Slovak cybersecurity company ESET dubbed the third wiper "CaddyWiper," which it said it first observed on March 14 around 9:38 a.m. UTC. Metadata associated with the executable shows that the malware was compiled at 7:19 a.m. UTC, a little over two hours prior to its deployment.

"This new malware erases user data and partition information from attached drives," the company said in a tweet thread. "ESET telemetry shows that it was seen on a few dozen systems in a limited number of organizations."

CaddyWiper is notable for the fact that it doesn't share any similarities with previously discovered wipers in Ukraine, including HermeticWiper and IsaacWiper, the two of which have been deployed in systems belonging to government and commercial entities.

"Interestingly, CaddyWiper avoids destroying data on domain controllers," the company said.

"The keys are unique for each encrypted file and are not stored anywhere, making the encryption irreversible and marking the malware as a wiper rather than a ransomware variant," the researchers noted.

News URL

https://thehackernews.com/2022/03/caddywiper-yet-another-data-wiping.html