Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
ESET Research Profile picture
@ESETresearch
Mar 14, 2022 • 7 tweets • 4 min read • Read on X
#BREAKING #ESETresearch warns about the discovery of a 3rd destructive wiper deployed in Ukraine 🇺🇦. We first observed this new malware we call #CaddyWiper today around 9h38 UTC. 1/7 ImageImage
This new malware erases user data and partition information from attached drives. #ESET telemetry shows that it was seen on a few dozen systems in a limited number of organizations. 2/7
CaddyWiper does not share any significant code similarity with #HermeticWiper, #IsaacWiper or any other malware known to us. The sample we analyzed was not digitally signed. 3/7
Similarly to HermeticWiper deployments, we observed CaddyWiper being deployed via GPO, indicating the attackers had prior control of the target's network beforehand. 4/7
Interestingly, CaddyWiper avoids destroying data on domain controllers. This is probably a way for the attackers to keep their access inside the organization while still disturbing operations. 5/7 Image
Information from the PE header of CaddyWiper suggests it was compiled the same day it was deployed to targeted networks. 6/7 Image
IoCs
98b3fb74b3e8b3f9b05a82473551c5a77b576d54 (caddy.exe)
ESET detection name: Win32/KillDisk.NCX
#ESETresearch
7/7

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with ESET Research

ESET Research Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @ESETresearch

ESET Research Profile picture
Sep 26
By analyzing thousands of samples, #ESETresearch has conducted a comprehensive technical analysis of the toolset the 🇷🇺Russia-aligned #Gamaredon #APTgroup used in 2022 and 2023 to spy on Ukraine🇺🇦 . 1/9welivesecurity.com/en/eset-resear…
This most active APT group in Ukraine doesn’t try to be stealthy and relies on extensive obfuscation, constant switching between C&C servers, and regular updates of its arsenal with new malware and other tools at a rapid pace, as depicted in the image below. 2/9 Image
#Gamaredon’s initial attack involves #spearphishing and then, for lateral movement, custom malware weaponizes existing and new Word documents and USB drives, which are hoped to be shared among potential victims. Word docs are weaponized either by #PteroTemplate or #PteroDoc. 3/9 Image
Read 9 tweets
ESET Research Profile picture
Jul 18
#ESETresearch discovered a signed, vulnerable, ad-injecting driver from a mysterious Chinese company. This threat, which we dubbed HotPage, comes self-contained in an executable that installs its main driver and injects libraries into Chromium-based browsers. 1/7
Image
Image
Using Windows’ notification callbacks, the driver component monitors new browsers or tabs being opened. Under certain conditions, the adware will use various techniques to inject shellcode into browser processes to load network-tampering libraries. 2/7
Image
Image
Using Microsoft’s Detours hooking library, the injected code filters HTTP(S) requests and responses. The malware can replace the content of the current page, redirect the user, or simply open a new tab to a website full of gaming ads. 3/7 Image
Read 7 tweets
ESET Research Profile picture
Aug 30, 2023
#ESETresearch identified two GREF campaigns targeting #Android users with @signalapp and @telegram apps trojanized into cyberespionage tools .
@LukasStefanko

1/9 welivesecurity.com/en/eset-resear…
Image
Signal Plus Messenger and FlyGram were built by merging the BadBazaar espionage code, previously used to target #Uyghurs and other #Turkic minorities, into the respective base app’s code. 2/9
The purpose of both apps is data exfiltration. Signal Plus Messenger presents the first documented case of spying on a victim’s Signal communications by secretly autolinking the compromised device to the attacker’s Signal device. 3/9 Image
Read 9 tweets
ESET Research Profile picture
May 10, 2023
#ESETResearch warns about a CPIO archive named “Jump Crypto Investment ” uploaded to VirusTotal from the USA 🇺🇸. It is another malicious PDF viewer distributed by #Lazarus #APT for #macOS @pkalnai @michalmalik 1/7 Agreement.zip

Image
@pkalnai @michalmalik The archive contains a fully functional – but malicious – PDF viewer, and a crafted “locked” PDF file. When the file is opened in the viewer, the malicious code is triggered. The functionality is very similar to the malware reported by @JamfSoftware. 2/7 jamf.com/blog/bluenorof…
Image
@pkalnai @michalmalik @JamfSoftware First, the malicious PDF viewer decrypts a decoy document embedded inside the original PDF file, and displays it to the target. 3/7 Image
Read 7 tweets
ESET Research Profile picture
Apr 20, 2023
#ESETResearch confirms Lazarus is linked to the recent #3CX supply-chain attacks. Based on code similarities and network infrastructure, we connect the 3CX incident with a Linux case of DreamJob, a long-term Lazarus operation using job offer as lures. 1/6 welivesecurity.com/2023/04/20/lin…
First, let’s look at the timeline. It shows that the trojanized macOS version of the 3CX Desktop App was ready two months prior to the distribution of the Windows version. Also interesting is that the attack was in preparation as early as December 2022. 2/6 Image
It was reported that Mandiant has found Mac malware they call SIMPLESEA inside the 3CX network. While we do not have the sample, their description of this malware overlaps with second-stage Linux malware we found while investigating a recent Operation DreamJob case. 3/6 Image
Read 6 tweets
ESET Research Profile picture
Mar 14, 2023
#ESETResearch discovered an attack by APT group Tick against a data-loss prevention (DLP) company in East Asia and found a previously unreported tool used by the group. welivesecurity.com/2023/03/14/slo… @0xfmz 1/6
In 2021, in the DLP company’s network, the attackers introduced trojanized installers of the legitimate application Q-dir, part of a toolkit used by the company. When executed, the installer dropped the open-source ReVBShell backdoor and ran the original Q-dir application. 2/6 Image
Subsequently, in 2022, on customers of the DLP company’s software, the trojanized Q-dir installers were deployed using remote support tools. Our hypothesis is that this occurred while the DLP company provided technical support to their customers. 3/6
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(