Executive Summary
A novel destructive campaign involving 'Lotus Wiper' was identified targeting the energy and utilities sector in Venezuela during late 2025 and early 2026. The attack utilizes a multi-stage execution chain initiated by batch scripts that coordinate destruction across network domains. The campaign is characterized by its lack of financial motivation, focusing instead on permanent data destruction and rendering systems unrecoverable.
The technical workflow involves disabling security services, modifying user accounts to block access, and utilizing 'Living off the Land' (LotL) techniques with tools like diskpart, robocopy, and fsutil. The final wiper payload, often masquerading as HCL Domino components, systematically overwrites physical drives with zeroes, deletes volume shadow copies/restore points, and clears USN journals to hinder forensic recovery.
This threat is highly targeted and suggests the attackers had long-term access to the victim's environment, as evidenced by scripts designed to handle legacy Windows systems. The impact is severe, aiming for total operational disruption of critical infrastructure.