{
  "source_id": "eset-industroyer2-caddywiper-2022",
  "source_key": "eset-industroyer2-caddywiper-2022",
  "title": "Industroyer2: Industroyer reloaded",
  "publisher": "ESET Research / WeLiveSecurity",
  "source_url": "https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/",
  "originally_published": null,
  "most_recently_updated": null,
  "first_collected": "2026-10-22T19:51:52+00:00",
  "last_successfully_checked": "2026-10-22T19:51:52+00:00",
  "original_content_digest": "5f1a6fb16fe6c018a29fe7325198af80379d6fcc65f50bfae94615a962e95d91",
  "source_publication_date": "2022-04-12",
  "date_precision": "day",
  "affected_platform": "Windows / Linux / Solaris / industrial control environments",
  "date_note": "Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.",
  "review_decision": "include",
  "reason_codes": [
    "editor-approved",
    "ESET’s original incident analysis explicitly connects scheduled destructive activity with erasing traces and discusses impaired recovery. This supplies a concrete evidentiary consequence beyond generic wiper coverage."
  ],
  "editorial_annotation": "ESET and CERT-UA investigated an energy-sector attack involving Industroyer2 and destructive malware. ESET distinguishes observed deployment from assessed purpose; examine surviving remote records and source collections without assuming every affected system or copy had the same outcome.",
  "topic": "Evidence availability",
  "evidence_quote_reference": {
    "short_quote": "erase Industroyer2 traces",
    "section": "Reviewed original report; locate the quoted phrase in context."
  },
  "editor_reviewed": "2026-10-22",
  "historical": true,
  "related_guide_urls": [
    "https://anti-forensics.com/reference/techniques/recovery-and-absence-claims/",
    "https://anti-forensics.com/reference/field-guides/corroborating-a-timeline/",
    "https://anti-forensics.com/reference/field-guides/collection-provenance-record/"
  ],
  "record_version_digest": "9a7ca0a4ce6072a57164fa1dacda9419f88bf3de48d489aab83e7a2336650f25"
}