LazyWiper
LazyWiper is a destructive PowerShell-based wiper used in the 2025 Poland wiper attacks. Reporting ties its use to coordinated sabotage operations in Poland affecting a manufacturing-sector company and, more broadly in campaign reporting, attacks against renewable energy sites and a combined heat and power facility. CERT Polska reporting cited in the content associates the broader campaign with the Russia-linked activity cluster Static Tundra (also tracked as Berserk Bear, Ghost Blizzard, and Dragonfly), while some reporting noted possible but inconclusive similarities to Sandworm-linked tradecraft.
The malware is described as a PowerShell script that targets a wide range of file types and partially overwrites files to render them unusable; other reporting in the content states it overwrites files with pseudorandom 32-byte sequences. It is characterized as a destructive component with no ransom or extortion behavior mentioned, and in some reporting as a redundant tool intended to ensure destruction if a primary payload fails. One documented capability is disabling Microsoft Windows Defender Real-Time Monitoring via the Set-MpPreference cmdlet.
In the manufacturing-company incident, LazyWiper was distributed through Active Directory Group Policy Objects to destroy business-critical data after the attackers had already obtained administrative access in the Windows domain. The broader intrusion context in the campaign included initial access through internet-exposed FortiGate perimeter/VPN devices lacking MFA, lateral movement, credential theft, and in some cases OT-focused sabotage, but LazyWiper itself is specifically described as the PowerShell wiper used for destructive file corruption. Multiple sources in the content state analysts believe parts of LazyWiper, particularly its file-overwrite function, may have been partially generated by AI or an LLM.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“The destructive phase relied on a PowerShell-based wiper referred to as LazyWiper, which was distributed through Group Policy Objects with the goal of destroying business-critical data.”
Techniques & procedures
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Although the intrusion itself relied on familiar techniques such as credential abuse and prolonged reconnaissance, the introduction of a custom, disposable wiper illustrates how generative approaches can be used to rapidly produce tailored payloads aligned with specific operational goals.
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Although the intrusion itself relied on familiar techniques such as credential abuse and prolonged reconnaissance, the introduction of a custom, disposable wiper illustrates how generative approaches can be used to rapidly produce tailored payloads aligned with specific operational goals.
Privilege Escalation
2 techniques
Privilege Escalation
Although the intrusion itself relied on familiar techniques such as credential abuse and prolonged reconnaissance, the introduction of a custom, disposable wiper illustrates how generative approaches can be used to rapidly produce tailored payloads aligned with specific operational goals.
Stealth
2 techniques
Stealth
The wiper was designed to erase system files and disrupt operational environments rather than establish long‑term access... such payloads... focus on a narrow set of actions such as file deletion, configuration corruption, or device destabilization.
Although the intrusion itself relied on familiar techniques such as credential abuse and prolonged reconnaissance, the introduction of a custom, disposable wiper illustrates how generative approaches can be used to rapidly produce tailored payloads aligned with specific operational goals.
Defense Impairment
1 technique
Defense Impairment
Impact
1 technique
Impact
Other
2 techniques
Other
The content repeatedly describes threat actors and malware disabling or modifying security tools, EDR/AV, logging, firewall rules, integrity checkers, and security settings; e.g., 'Agrius used several mechanisms to try to disable security tools' and 'BlackByte disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.'
Examples include 'Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools', 'BlackByte disabled security tools such as Windows Defender', 'Scattered Spider has uninstalled and disabled security tools', and many malware families terminating AV/EDR processes or services.
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A destructive PowerShell wiper used to erase system files and disrupt operations, reportedly generated with AI assistance for a targeted sabotage campaign.
Wiper malware used to destroy data at a manufacturing-sector victim during the 2025 Poland Wiper Attacks.
PowerShell-based destructive wiper used to overwrite/destroy business-critical data; distributed via Active Directory Group Policy Objects (GPO).
Destructive wiper malware used alongside DynoWiper in attacks on Poland’s energy-sector OT; appears to be an alternate/redundant destructive payload to ensure disruption if the primary wiper fails.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.