DEADWOOD — Malware Profile

DEADWOOD is wiper malware written in C++ using Boost libraries. DEADWOOD was first observed in an unattributed wiping event in Saudi Arabia in 2019, and has since been incorporated into Agrius operations.

MITRE ATT&CK techniques (10)

• T1027.009 Embedded Payloads
• T1027.013 Encrypted/Encoded File
• T1036.004 Masquerade Task or Service
• T1124 System Time Discovery
• T1140 Deobfuscate/Decode Files or Information
• T1485 Data Destruction
• T1531 Account Access Removal
• T1561.001 Disk Content Wipe
• T1561.002 Disk Structure Wipe
• T1569.002 Service Execution

Attributed threat actors

• Agrius
• APT33

Read the full analysis on IntelFusions