TLDR Tech / InfoSec
Mystery Around Venezuelan Cyberattack Deepens, with New Discovery of "Highly Destructive" Wiper
Lotus Wiper is a destructive malware family with PDVSA.com hardcoded into its OhSyncNow.bat trigger script that overwrites drives, deletes backups, and scrubs system logs to render machines unrecoverable, with a compilation timestamp from late September 2025 suggesting months of attacker preparation. Researcher Ben Read flagged the embedded domain as evidence of a precision weapon aimed at Venezuela's state oil company, and a Venezuelan submitter uploaded the binaries to VirusTotal on December 14, one day after the December 13 PDVSA breach that Bloomberg later reported had crippled administrative systems, SCADA at refineries and pipelines, and payroll for over a month. The wiper specifically suppresses the Windows Interactive Services Detection service removed after Windows 10 v1803, indicating prior reconnaissance of PDVSA's sanctions-frozen legacy stack and raising fresh questions about US involvement given the proximity to January's military operation that seized Maduro.
Read the full story