New Lotus data wiper used against Venezuelan energy, utility firms

Kaspersky analyzed a previously undocumented data-wiping malware called Lotus used in targeted attacks against Venezuelan energy and utility organizations; attackers used preparatory batch scripts to disable defenses and accounts, then deployed a low-level wiper that clears USN journals, deletes restore points, overwrites physical disk sectors, and zeroes files to render systems unrecoverable. The report highlights precursor TTPs (UI0Detect manipulation, NETLOGON share changes, mass account modifications, and unusual use of diskpart/robocopy/fsutil) and recommends monitoring these indicators and maintaining validated offline backups.