Lotus Wiper

Lotus Wiper is a previously undocumented destructive wiper used in a targeted campaign against energy and utilities organizations in Venezuela in late 2025 and early 2026. Unlike ransomware, it carries no extortion path and no recovery bargain. Its purpose is destruction. It overwrites drive contents with zeroes, destroys recovery mechanisms, erases file records, and leaves affected systems unbootable and unrecoverable.

What makes this campaign strategically significant is not just the payload. It is the preparation. Lotus Wiper was compiled in late September 2025 and staged months in advance on domain-joined hosts. The attack chain was designed so that a single control file placed in NETLOGON could trigger simultaneous destructive execution across the victim environment, compressing defender response time to almost nothing.

The implications extend far beyond Venezuela. Lotus Wiper was built for the exact Windows environments many industrial organizations still depend on: engineering workstations, SCADA servers, data historians, and HMI systems running legacy operating systems for operational continuity reasons. It does not need to touch a PLC to create operational impact. It destroys the Windows layer that OT operations rely on.

• ▸Lotus Wiper appears purpose built for a single campaign and a single victim environment, with no prior or subsequent public deployments.
• ▸The operation required months of prior domain access and detailed knowledge of the target's internal environment, including internal account naming conventions.
• ▸The malware chain was explicitly designed for legacy Windows systems common in OT-adjacent environments, including Windows 7, Server 2008, and Server 2012.
• ▸The trigger mechanism allowed simultaneous network-wide execution through a single file placed in the NETLOGON share, collapsing defender response time to near zero.
• ▸Lotus Wiper destroys restore points, zeroes physical drives, erases file system artifacts, disables network interfaces, and locks out accounts before the final payload phase.
• ▸No attribution is established in open reporting, but the campaign profile is consistent with state-sponsored offensive cyber activity timed to a strategic objective.

Lotus Wiper is not opportunistic malware. It is a long-dwell, environment-aware, destructive capability designed for coordinated impact. The staging model confirms that attackers had sustained access to the target environment well before detonation. Batch scripts hardcoded the victim organization's name, executables were pre-positioned on domain-joined hosts, and the execution architecture depended on domain-wide coordination. That is not smash-and-grab intrusion behavior. It is operational preparation.

The campaign unfolded against a period of intensified hostile activity in Venezuela's energy sector. The bulletin notes a separate December 2025 cyberattack against PDVSA and the January 2026 U.S. operation in Venezuela that included publicly acknowledged cyber effects and widespread power disruption in Caracas. No open source reporting establishes attribution for Lotus Wiper, but the timing, tooling profile, and absence of financial motive make the geopolitical context analytically significant.

Technically, the malware is notable for how little it relies on exotic code during the preparation phase. It uses native Windows tooling, manipulates legacy services, disables accounts, severs connectivity, fills available disk space, stages copied system binaries in a working directory, and then decrypts and launches the actual wiper. The result is a destruction model that blends in early, then detonates fast.

The most important defensive takeaway is that Lotus Wiper achieves OT impact without ICS-specific manipulation. It never needs to speak an industrial protocol. By destroying engineering workstations, SCADA servers, historians, and HMI-supporting Windows systems, it can still cause loss of control, loss of view, and prolonged operational disruption. That makes this campaign highly relevant to energy, utilities, water, and manufacturing operators worldwide.

Lotus Wiper is highly destructive, but it is detectable if organizations are watching the right control points early enough. The most critical detections target the coordination and preparation phase, before detonation begins. By the time the final wipe payload is actively zeroing disks, recovery options have already collapsed. A minimum 90-day historical lookback is recommended given this campaign's months-long staging window. Bulk execution of diskpart, robocopy, fsutil, and netsh at production scale has almost no legitimate operational equivalent and should be treated as a high-confidence signal cluster.

Lotus Wiper's architecture depends on a few critical control failures: write access to NETLOGON, domain-level pre-positioning, reliance on restorable but online backups, and unsegmented legacy Windows systems. Those are all addressable. The controls below directly target the attack chain's most critical dependencies.