Venezuela energy sector targeted by highly destructive Lotus wiper

Kaspersky researchers identified a targeted destructive campaign (Lotus Wiper) against Venezuela's energy and utilities sector in 2025–2026: attackers used coordinated batch scripts (e.g., OhSyncNow.bat) to disable defenses, isolate systems, and prepare the environment, then deployed a wiper that removes recovery mechanisms, overwrites physical drives, deletes and corrupts files and logs, and leaves systems unrecoverable; the report provides IOCs, TTPs (use of diskpart, robocopy, fsutil, NETLOGON monitoring), and mitigation advice including auditing domain shares, monitoring token/credential abuse, and robust backup testing.