A fourth data wiping malware has been leveraged against Ukraine since the start of this year. Following the attacks of WhisperGate, HermeticWiper, and IsaacWiper, CaddyWiper was discovered by ESET researchers early Monday morning. There is not much information surrounding CaddyWiper due to its recent appearance, though ESET was able to confirm the CaddyWiper code is not similar to the other malware. From an initial investigation, the researchers found that the wiper malware was uniquely selective in which systems it would destroy. For example, if the malware discovered the infected computer was a domain controller, it would refuse to wipe the system. The researchers noted that this is most likely to allow the malware to persist in the network for as long as possible. They were also able to determine the method the malware used to spread across a network. CaddyWiper leverages group policy object (GPO), a built-in Windows feature to give organizations control over settings and software used by computers in the domain. By creating a GPO entry for its installer, CaddyWiper is deployed to every system in the organization’s network. It is clear that these four malware attacks against Ukraine are a direct cause of the conflict with Russia and, with no end in sight, CTIX analysts predict malware attacks against Ukraine will continue.