Lotus Wiper Hits Energy Sector in Destructive Cyberattack

Lotus Wiper is a destructive malware campaign observed against Venezuelan energy and utilities organizations that uses network-wide batch-script orchestration (OHSync.xml via NETLOGON) and living-off-the-land tools (diskpart, robocopy, fsutil), followed by a low-level wiper that removes restore points, clears USN journals, and overwrites physical drives, leaving systems unrecoverable; artifacts indicate months of prior access and strategic (non-financial) motivations.