Lotus Wiper Malware Targets Venezuelan Energy Systems in Destructive Attack

Kaspersky researchers identified "Lotus Wiper," a previously unknown destructive file wiper used in late 2025–early 2026 attacks targeting Venezuela's energy and utilities sector; the campaign leverages two batch scripts to coordinate network-wide destructive actions (stopping legacy services, checking NETLOGON shares, disabling logins, deactivating interfaces) and then uses native Windows tools (diskpart, robocopy, fsutil) and a wiper payload to overwrite physical sectors, delete files and restore points, and render systems inoperable—organizations should monitor NETLOGON activity, credential/privilege escalation signs, and misuse of native utilities.