DEADWOOD

DEADWOOD is wiper malware written in C++ using Boost libraries. DEADWOOD was first observed in an unattributed wiping event in Saudi Arabia in 2019, and has since been incorporated into Agrius operations.

View graph Watch Export

Indicators tracked

Intelligence Reports10

10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

13 relationships

T1027.009: Embedded Payloads

source

T1561.002: Disk Structure Wipe

source

T1027.013: Encrypted/Encoded File

source

T1140: Deobfuscate/Decode Files or Information

source

T1036.004: Masquerade Task or Service

source

T1531: Account Access Removal

source

T1485: Data Destruction

source

T1569.002: Service Execution

source

T1124: System Time Discovery

source

T1561.001: Disk Content Wipe

source