Lotus Wiper Used in Attacks on Venezuelan Energy and Utilities Organizations
Summary
Kaspersky analyzed Lotus, a previously undocumented wiper reportedly used against Venezuelan energy and utilities organizations. Preparatory scripts disable defenses and hinder recovery before Lotus overwrites disks and removes recovery options.
Key points
- Kaspersky analyzed Lotus after it was uploaded from a machine in Venezuela in mid-December.
- The OhSyncNow.bat script disables UI0Detect and coordinates execution across domain-joined systems.
- The notesreg.bat script can disable accounts and network interfaces, log off sessions, and deactivate cached logins.
- Preparatory scripts use diskpart, robocopy, and fsutil to overwrite drives and fill free space.
- Lotus uses IOCTL calls to overwrite physical disk sectors, clears the USN journal, deletes restore points, and removes files.
- Kaspersky recommends monitoring for NETLOGON share changes, UI0Detect manipulation, mass account changes, disabled network interfaces, and unexpected diskpart, robocopy, or fsutil activity.
- The article says there is no public evidence that PDVSA’s systems were wiped in a separate reported attack.
Article Details
- Attack Vectors
- Attackers ran OhSyncNow.bat to disable the UI0Detect service and coordinate execution across domain-joined systems.
- When specified conditions were met, notesreg.bat enumerated users, changed passwords to disable accounts, logged off active sessions, disabled network interfaces, and deactivated cached logins.
- Preparatory scripts used diskpart clean all, robocopy, and fsutil to overwrite drive contents and fill free space before decrypting and executing the Lotus wiper.
- Lotus used disk IOCTL calls to overwrite physical sectors, cleared the USN journal, deleted restore points, and zeroed and removed files.
- Defensive Notes
- Monitor for NETLOGON share changes, UI0Detect manipulation, mass account changes, and unexpected disabling of network interfaces.
- Treat unexpected use of diskpart, robocopy, and fsutil as a red flag.
- Maintain regular offline backups and frequently validate that they can be restored.
MITRE ATT&CK
T1059.003 · Windows Command ShellThe attackers used OhSyncNow.bat and notesreg.bat to prepare systems and coordinate activity.T1070 · Indicator RemovalLotus cleared USN journal entries to remove traces of file-system activity.T1485 · Data DestructionLotus destroyed data by zeroing and removing files across affected volumes.T1490 · Inhibit System RecoveryLotus deleted Windows restore points, and the preparatory scripts made recovery harder by overwriting drives and filling free space.T1531 · Account Access Removalnotesreg.bat disabled user accounts by changing their passwords.T1561.001 · Disk Content WipeThe scripts and Lotus overwrote drive contents, including physical sectors, with zeroes.T1562.001 · Disable or Modify ToolsThe preparatory activity weakened defenses by disabling the UI0Detect service.
Malware
Products
Tools
diskpartAttackers used preparatory batch scripts to disable defenses, wipe drives with tools like diskpart/robocopy/fsutil, and then deploy the Lotus wiper to overwrite physical sectors, delete recovery mechanisms, and renderfsutil.exeused preparatory batch scripts to disable defenses, wipe drives with tools like diskpart/robocopy/fsutil, and then deploy the Lotus wiper to overwrite physical sectors, delete recovery mechanisms, and renderrobocopyAttackers used preparatory batch scripts to disable defenses, wipe drives with tools like diskpart/robocopy/fsutil, and then deploy the Lotus wiper to overwrite physical sectors, delete recovery mechanisms, and render
Countries
Industries
Energyis a previously undocumented data-wiping malware used last year in targeted attacks against Venezuelan energy and utilities organizations, and it was analyzed by Kaspersky after being uploaded from a machine inUtilitiesundocumented data-wiping malware used last year in targeted attacks against Venezuelan energy and utilities organizations, and it was analyzed by Kaspersky after being uploaded from a machine in Venezuela.