New Wiper Malware Targeted Venezuelan Energy Sector Prior to US Intervention

Summary

Kaspersky discovered Lotus Wiper, a destructive wiper malware compiled in September 2025 and used in attacks against Venezuela's energy and utilities sector. The attack chain leverages two batch scripts to disable defenses and establish network-based execution triggers before deploying the wiper payload, which overwrites drives and deletes files systematically. The timing and lack of ransom demands suggest state-sponsored involvement linked to geopolitical tensions in the Caribbean and alleged US-directed cyberattacks during the January 2026 intervention.

Full text

A threat actor has used a new wiper malware in recent attacks against the energy and utilities sector, cybersecurity company Kaspersky warns. The attack targeted an organization in Venezuela and relied on two batch scripts to weaken defenses and disrupt operations before retrieving the final payload, the Lotus Wiper. Likely compiled in September 2025, the wiper and associated artifacts were uploaded in mid-December to a public platform. “The wiper removes recovery mechanisms, overwrites the content of physical drives, and systematically deletes files across affected volumes, ultimately leaving the system in an unrecoverable state,” Kaspersky explains. The lack of payment instructions or an extortion method, and the malware’s upload during a period of increased malware activity targeting the energy and utility sector in Venezuela, suggest that Lotus Wiper is extremely targeted, the cybersecurity firm says. The cybersecurity firm has not shared any information on attribution, but cited the “geopolitical tensions that occurred in the Caribbean region in late 2025 and early 2026”.Advertisement. Scroll to continue reading. It’s worth noting that, according to some reports, the United States’s extraction of Venezuelan President Nicolas Maduro in early January 2026 involved cyberattacks to trigger power outages and disable air defense radars. Lotus Wiper’s execution chain starts with a batch script that attempts to stop the legacy Windows service Interactive Services Detection (UI0Detect) to prevent visible warnings that a malicious activity occurs in the background. The malicious script appears built to run on older Windows versions that still run UI0Detect, as the service was officially removed from the OS in Windows 10 version 1803. Additionally, the script checks for a file on a NETLOGON share, coding the victim organization’s name in a variable to build the file path. If this file and a corresponding local file exist, it executes a second batch script. It exits if the remote file does not exist, but continues with the next stage even if the local file is missing. “This logic functions as a network-based trigger, where the presence of the remote XML file acts as a control signal to initiate execution across systems in the domain. This approach is consistent with classic backdoor trigger mechanisms that rely on externally accessible resources to control malware behavior,” Kaspersky explains. The second script checks for another file to determine if it has already run. If the file does not exist, it enumerates local user accounts, changes their passwords, disables cached logins, logs off active sessions, and disables network interfaces to prevent device access. It also enumerates logical drives, wipes their contents, copies Windows binaries to a working directory, mirrors folders to overwrite existing contents or delete them, and calculates the available free space to fill it with a large file, exhausting storage capacity. It then runs an executable, leading to Lotus Wiper’s retrieval and execution. The attacker, Kaspersky says, likely had prior access to the compromised system, as the binary was staged before the attack. The wiper “enables all privileges in its current token to access administrative functions (relying on pre-existing elevated rights), deletes restore points, and wipes every physical drive by writing all zeroes to its sectors. It then clears the update sequence numbers (USN) of the volumes’ journals and, finally, scans all the volumes looking for files to delete,” Kaspersky says. Related: ZionSiphon Malware Targets ICS in Water Facilities Related: Anubis Ransomware Packs a Wiper to Permanently Delete Files Related: ESET Distributor’s Systems Abused to Deliver Wiper Malware Related: New Reports Reinforce Cyberattack’s Role in Maduro Capture Blackout Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire Dozens of Malicious Crypto Apps Land in Apple App StoreProgress Patches Multiple Vulnerabilities in MOVEit WAF, LoadMasterOrganizations Warned of Exploited Cisco, Kentico, Zimbra Vulnerabilities$290 Million Kelp DAO Crypto Heist Blamed on North KoreaBritish Scattered Spider Hacker Pleads Guilty in the USHackers Abuse QEMU for Defense EvasionHalf of the 6 Million Internet-Facing FTP Servers Lack EncryptionHackers Fail to Exploit Flaw in Discontinued TP-Link Routers Latest News After Bluesky, Mastodon Targeted in DDoS AttackMost Serious Cyberattacks Against the UK Now From Russia, Iran and China, Cyber Chief SaysMirai Botnet Targets Flaw in Discontinued D-Link RoutersAre SBOMs Failing? Supply Chain Attacks Rise as Security Teams Struggle With SBOM DataClaude Mythos Finds 271 Firefox VulnerabilitiesNorth Korean Hackers Use AppleScript, ClickFix in Fresh macOS AttacksGoogle Antigravity in Crosshairs of Security Researchers, CybercriminalsOracle Patches 450 Vulnerabilities With April 2026 CPU Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: A Step-by-Step Approach to AI Governance April 28, 2026 With "Shadow AI" usage becoming prevalent in organizations, learn how to balance the need for rapid experimentation with the rigorous controls required for enterprise-grade deployment. Register Virtual Event: Threat Detection and Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register People on the MoveAnti-ransomware platform Halcyon has named Kirstjen Nielsen and Chris Inglis as Strategic Advisors.ThreatModeler has appointed Kevin Gallagher as Chief Executive Officer.Thomas Bain has been appointed Chief Marketing Officer at Silent Push.More People On The MoveExpert Insights Government Can’t Win the Cyber War Without the Private Sector Securing national resilience now depends on faster, deeper partnerships with the private sector. (Steve Durbin) The Hidden ROI of Visibility: Better Decisions, Better Behavior, Better Security Beyond monitoring and compliance, visibility acts as a powerful deterrent, shaping user behavior, improving collaboration, and enabling more accurate, data-driven security decisions. (Joshua Goldfarb) The New Rules of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental. It must be architectural. (Nadir Izrael) The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust Data integrity shouldn’t be seen only through the prism of a technical concern but also as a leadership issue. (Steve Durbin) Why Agentic AI Systems Need Better Governance – Lessons from OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — Lotus Wiper

Entities