cyber.hendryadrian.com
Threat Research · securityweek.com

Lotus Wiper Used Against Venezuelan Energy Organization, Kaspersky Says

· Original article ↗

Summary

Kaspersky describes Lotus Wiper, a destructive malware used against a Venezuelan energy organization. Two batch scripts prepare the system before the wiper deletes recovery mechanisms, overwrites physical drives and removes files. Attribution is unknown.

Key points

  • Kaspersky reports attacks targeting an organization in Venezuela’s energy and utilities sector; the actor has not been identified.
  • Two batch scripts prepare execution. The first checks for a victim-specific file on a NETLOGON share before launching the next stage.
  • The second script can change local account passwords, disable cached logins and network interfaces, and log off active sessions.
  • Before the final payload runs, the scripts wipe logical drives, overwrite files and can fill available storage.
  • Lotus Wiper deletes restore points, writes zeroes to physical drives, clears volume USN journals and deletes files.
  • Kaspersky says the binary was staged before the attack, suggesting the attacker had prior access; the article provides no attribution or extortion method.

Article Details

Attack Vectors
  • Two batch scripts weakened defenses and disrupted operations before retrieving and executing Lotus Wiper.
  • The first script used the presence of a victim-specific XML file on a NETLOGON share as a trigger to launch the next script.
  • The attacker likely had prior access to the compromised system; Kaspersky says the executable was staged before the attack.

MITRE ATT&CK

T1059.003 · Windows Command ShellThe attack used two batch scripts to carry out preparatory actions and initiate the wiper.T1087.001 · Local AccountThe second batch script enumerated local user accounts.T1485 · Data DestructionThe scripts overwrote logical-drive contents and Lotus Wiper systematically deleted files across affected volumes.T1489 · Service StopThe first script attempted to stop the Windows UI0Detect service.T1490 · Inhibit System RecoveryLotus Wiper deleted restore points to inhibit system recovery.T1499.001 · OS Exhaustion FloodThe second script calculated free space and filled it with a large file, exhausting storage capacity.T1531 · Account Access RemovalThe second script changed local account passwords, disabled cached logins, and logged off active sessions, disrupting user access.T1561.002 · Disk Structure WipeLotus Wiper wiped physical drives by writing zeroes to their sectors.

Malware

Lotus WiperThe attack targeted an organization in Venezuela and relied on two batch scripts to weaken defenses and disrupt operations before retrieving the final payload, the Lotus Wiper.

Products

Microsoft WindowsLotus Wiper’s execution chain starts with a batch script that attempts to stop the legacy Windows service Interactive Services Detection (UI0Detect) to prevent visible warnings that a malicious activity occurs in the

Countries

VenezuelaThe attack targeted an organization in Venezuela and relied on two batch scripts to weaken defenses and disrupt operations before retrieving the final payload, the Lotus Wiper.

Industries

EnergyA threat actor has used a new wiper malware in recent attacks against the energy and utilities sector, cybersecurity company Kaspersky warns.UtilitiesA threat actor has used a new wiper malware in recent attacks against the energy and utilities sector, cybersecurity company Kaspersky warns.

Related Articles