Threat Advisory: Caddy Wiper
Summary: ESET disclosed CaddyWiper on March 14, a 9KB wiper with the same compilation timestamp day that initial reports say was deployed via GPO. Before destroying files, it checks whether the machine is a domain controller and stops if it is; otherwise it takes file ownership via SeTakeOwnershipPrivilege, overwrites files with zeros on C:\Users and then drives D: through Z: (including mapped network drives), and in a second stage zeroes the drive layout of physical drives 9 to 0, wiping MBR, GPT and partition entries.
Key Takeaway: The wiper deliberately spares domain controllers and then reaches mapped network drives through Z:, so an infected workstation can carry the destruction onto shared storage while the domain controller that could help you respond is left untouched.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026