Lotus Wiper Hits Energy Sector in Destructive Cyberattack

Hackers have deployed a new destructive malware, dubbed Lotus Wiper , in a targeted cyberattack against energy and utilities organizations in Venezuela, aiming not to extort money but to destroy data and disrupt operations permanently.

Artifacts from the Lotus Wiper attack chain were uploaded to a public malware-sharing resource in mid-December 2025 from a machine in Venezuela, overlapping with reports of malicious activity against the country’s energy sector.

Indicators embedded in the samples and path names show that the intended victims operate in the utilities and energy domain, aligning with broader critical-infrastructure targeting trends in Latin America and the Caribbean.

Unlike ransomware, Lotus Wiper does not display ransom notes, payment instructions, or any extortion-related logic, reinforcing assessments that the operation is politically or strategically motivated rather than financially driven.

The campaign appears linked to rising geopolitical tensions in the Caribbean region in late 2025 and early 2026, and evidence suggests the attackers had long-term access to victim networks before triggering the wiper.

Compilation timestamps point to late September 2025, while the upload date in December suggests months of preparation and likely prior compromise of the impacted environment.

Batch scripts set up destruction

The attack chain begins with batch scripts that act as an orchestrated “kill switch” across the network, preparing systems for the final wipe.

OhSyncNow.bat is the first script observed; it creates a working directory (preferably C:\lotus), attempts to disable the legacy Interactive Services Detection (UI0Detect) service on older Windows systems, and then checks a NETLOGON share for a control XML file (OHSync.xml) used as a network-wide execution trigger.

If the remote marker is present, the script proceeds to run a second batch file, notesreg.bat, which first ensures it only executes once, then enumerates local user accounts, changes their passwords to random values, and marks most of them inactive effectively locking out legitimate users while sparing a few hard‑coded accounts.

It then disables cached logons via the Winlogon registry key, logs off active sessions, and runs netsh commands to disable network interfaces, cutting off external communication before data destruction begins.

The same script then moves into a fully destructive phase using built‑in Windows tools. It enumerates logical drives and invokes diskpart with the clean all command to overwrite volumes with zeroes, destroying partitions and data.

Using robocopy in mirror mode, it recursively overwrites or deletes folder contents across the system, followed by fsutil to create a huge filler file that consumes nearly all remaining free space, further complicating forensic recovery.

Finally, the script launches a fake HCL Domino executable named nstats.exe, passing two additional masquerading binaries (nevent.exe and ndesign.exe) as arguments; nstats.exe decrypts the wiper payload from one file into the other, restoring the final Lotus Wiper implant and executing it with elevated privileges.

This staging implies the attackers had already placed these binaries on multiple hosts, consistent with long‑standing backdoor access in the victim domain.

Lotus Wiper internals

Once running, Lotus Wiper enables all privileges in its current token, deletes Windows restore points using the System Restore API (srclient.dll), and systematically wipes physical drives by querying disk geometry and writing zeroes to every sector via low‑level IOCTL calls.

It repeatedly clears the USN change journal, enumerates volumes, and launches threads that zero out file contents, rename them to random hexadecimal strings, and delete them resorting to MoveFileExW with delayed delete flags when files are locked.

Because Lotus Wiper removes restore points, clears journals, overwrites disks, and deletes files in multiple passes, compromised systems are left unbootable and effectively unrecoverable, placing it in the same destructive class as historical incidents like NotPetya and HermeticWiper.

Security teams in energy and government environments should closely monitor NETLOGON and domain shares for unexpected XML or script files that could serve as coordinated execution triggers, as seen with OHSync.xml.

They should also hunt for suspicious use of “living off the land” tools such as diskpart, robocopy, and fsutil at scale, which may signal preparation for a wiper event.

Given that Lotus Wiper requires elevated privileges, organizations must strengthen credential hygiene and monitor for token abuse, credential dumping, and anomalous admin activity, particularly on legacy Windows systems that may still expose services like UI0Detect.

Finally, resilient, segmented backups, regularly tested for restoration against full‑disk wipe scenarios, remain critical to surviving this kind of destructive attack when prevention and detection fail.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.