DynoWiper Data-Wiping Malware Attacking Energy Companies to Destroy Data

DynoWiper is a destructive data-wiping malware observed in December 2025 targeting a Polish energy firm; attributed to the Sandworm APT and similar to the ZOV wiper, it overwrites files using a 16-byte buffer and was deployed via Active Directory Group Policy after attackers performed credential theft (Rubeus, LSASS dumping) and established reverse connections via a SOCKS5 proxy. Multiple variants and iterative attempts to bypass defenses were noted, but endpoint detection and response successfully blocked execution and significantly limited impact.