Loading story…
Kaspersky reported that a previously undocumented malware strain, Lotus Wiper, was used in targeted attacks against energy and utilities organizations in Venezuela, with activity spanning late 2025 into 2026. The operation used batch scripts including OhSyncNow.bat and notesreg.bat to coordinate execution across victim networks, weaken defenses, disable accounts and logins, alter NETLOGON share access, shut down network interfaces, and otherwise prepare systems for destructive action before launching the final payload. Researchers said the campaign appeared aimed at critical infrastructure disruption rather than extortion, with no ransom demand observed and indications the attackers likely understood the victim environments and may have maintained access for months before deployment.
Once executed, Lotus Wiper was designed to make recovery extremely difficult or impossible by deleting restore points, clearing logs and USN journal entries, overwriting files, mounted volumes, and physical disks with zeroes, and repeatedly wiping sectors through low-level disk IOCTL operations. Kaspersky said the malware was uploaded from a machine in Venezuela and noted temporal overlap with broader regional tensions and a separate cyberattack that disrupted PDVSA delivery systems, though there is no public evidence that PDVSA itself was hit by Lotus. Defenders were advised to watch for precursor behaviors such as UI0Detect manipulation, mass account changes, disabled network interfaces, and suspicious use of tools like diskpart, robocopy, and fsutil, while maintaining validated offline backups.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Kaspersky publicly reported and analyzed the Lotus wiper campaign, describing its destructive capabilities, likely prolonged attacker access, and indicators defenders should monitor. The report framed the activity as a deliberate critical infrastructure disruption campaign rather than financially motivated crime.
Around the same period in December 2025, a separate cyberattack disrupted PDVSA delivery systems during heightened regional geopolitical tensions. Public reporting did not establish that PDVSA was hit by Lotus or suffered data wiping.
In mid-December 2025, a previously undocumented destructive malware later named Lotus was used in targeted attacks against energy and utilities organizations in Venezuela. The attack chain used batch scripts to disable defenses, disrupt access, and prepare systems for irreversible wiping before launching the payload.
Kaspersky said Lotus Wiper was compiled in late September 2025, suggesting the destructive campaign had been prepared for months before it was deployed. This provides an earlier technical origin point for the operation than previously documented.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcetherecord.media
Open sourceinfosec.pub
Open sourcesecurelist.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A targeted cyber-espionage operation has been reported against **U.S. government and policy-focused organizations**, using Venezuela-themed spear-phishing lures to deliver a custom backdoor dubbed **LOTUSLITE**. The activity has been attributed with *moderate confidence* to the China-aligned threat actor **Mustang Panda** (also tracked as *Earth Preta*, *HoneyMyte*, and *Twill Typhoon*), based on overlaps in tradecraft and infrastructure consistent with prior campaigns. The initial access method relies on a malicious ZIP archive named `US now deciding what’s next for Venezuela.zip`, which contains a legitimate executable (described as a renamed Tencent music streaming service binary, e.g., `Maduro to be taken to New York.exe`) and a malicious DLL `kugou.dll`. When the signed/legitimate executable is launched, it **DLL-sideloads** the malicious DLL, executing LOTUSLITE without requiring exploit-based intrusion; reporting characterizes the campaign as limited in scale but highly precise in targeting, and notes the implant is a custom C++ espionage tool with persistence mechanisms despite indications of relatively low development maturity in parts of the loader.
Jun 29, 2026
Reporting described multiple state-linked cyber activities tied to geopolitical events, including a phishing campaign attributed with **moderate confidence** to China-nexus espionage group **Mustang Panda** (aka **UNC6384**, **Twill Typhoon**) that used the capture of Venezuelan President **Nicolás Maduro** as a lure to target US government agencies and policy organizations. Acronis researchers identified a ZIP lure (“US now deciding what’s next for Venezuela”) containing a legitimate executable side-loaded with a hidden DLL backdoor dubbed **Lotuslite**, though it remains unclear whether any targets were successfully compromised. Separately, unnamed US officials cited by *The New York Times* claimed a “precise” US cyber operation—reportedly involving **US Cyber Command**—briefly disrupted electricity in **Caracas** and interfered with Venezuelan military radar to support the helicopter mission that captured Maduro, but public technical details of the methods used were not provided. In Europe, **Poland** said it repelled what it described as its most serious cyberattack on energy infrastructure in years after attackers targeted communications between distributed renewable generation (solar and wind) and electricity distribution operators, an incident officials said came close to a blackout and “everything points to” **Russian sabotage,” while withholding specific technical indicators or a formal threat-actor attribution.
Jun 29, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026