malware

DEADWOOD

S1134 · ATT&CK v19.2

Platforms

Windows

Tracked actors

Description

[DEADWOOD](https://attack.mitre.org/software/S1134) is wiper malware written in C++ using Boost libraries. [DEADWOOD](https://attack.mitre.org/software/S1134) was first observed in an unattributed wiping event in Saudi Arabia in 2019, and has since been incorporated into [Agrius](https://attack.mitre.org/groups/G1030) operations.(Citation: SentinelOne Agrius 2021)

Actors that use this

2 tracked actors

Agrius (Agonizing Serpens / BlackShadow)ATT&CK-attributed

APT33ATT&CK-attributed