DynoWiper
DynoWiper is a destructive data-wiping malware first documented by ESET during a late-December 2025 cyber incident affecting Poland’s energy sector and critical infrastructure. It is also detected as Win32/KillFiles.NMO. Reporting describes it as a previously undocumented custom wiper used to damage systems and render them inoperable rather than for espionage, theft, or financial gain.
High-confidence reporting states DynoWiper was used during the 29–30 December 2025 attacks against Poland’s energy infrastructure, including renewable-energy environments and a combined heat and power plant. During that campaign, it was deployed via Group Policy Objects from a domain controller and accessible network shares after attackers had already obtained elevated privileges and moved laterally through victim networks. It was used alongside built-in commands to destroy data on Windows HMI workstations and OT-related assets including Mikronika RTUs and Hitachi Relion protection and control relays; a separate PowerShell wiper, LazyWiper, was also observed in related activity.
Technical reporting indicates DynoWiper enumerates logical drives, including fixed and removable drives, and overwrites file contents to make recovery difficult or impossible. One analyzed variant corrupts file headers with random data and, for larger files, overwrites multiple random offsets before deleting file entries. Reported exclusions include system-critical directories such as Windows, System32, Program Files, AppData, Temp, Boot, and Recycle Bin paths, apparently to preserve enough system stability to complete destructive actions. Some reporting states DynoWiper forces a reboot after wiping by enabling shutdown privileges and invoking ExitWindowsEx, while another documented version removed the shutdown behavior and inserted a short delay between corruption and deletion phases. Additional reporting describes targeting of Windows boot configuration and use of commands such as vssadmin delete shadows and bcdedit /set to inhibit recovery.
Attribution in the provided content is mixed. ESET attributed DynoWiper to Sandworm with medium confidence based on overlaps in tactics, coding patterns, and similarities to prior Sandworm-linked wipers such as ZOV/ZOVWiper. Other reporting and CERT Polska linked the broader Poland campaign to the Russia-linked cluster Static Tundra, also tracked as Berserk Bear, Ghost Blizzard, and Dragonfly, with Hunt.io noting infrastructure overlaps involving DynoWiper activity. The malware is therefore associated in the content with Russian state-linked destructive operations against Polish energy infrastructure, but actor attribution is not uniform across sources.
Known indicators directly mentioned in the content include SHA-1 4EC3C90846AF6B79EE1A5188EEFA3FD21F6D4CF6 and SHA-256 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A decade later, the same group demonstrated that this capability now extends to NATO territory, deploying DynoWiper malware against Poland’s energy infrastructure in December 2025.
Malware Family DYNOWIPER Destructive wiper malware attributed to ENERGETIC BEAR; hosted on CLODO CLOUD SERVICE (UAE)
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
3 techniques
Execution
“Distribution of the wiper within the domain using a Scheduled Task” / “defines a ScheduledTask that executes with NT AUTHORITY\SYSTEM… deletes itself…”
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
2 techniques
Stealth
Defense Impairment
1 technique
Defense Impairment
Discovery
1 technique
Discovery
Command and Control
1 technique
Command and Control
Impact
4 techniques
Impact
Sandworm... deploying DynoWiper malware against Poland’s energy infrastructure... Iran-linked hackers have wiped the data of over 50 small Israeli companies since the war began... used Microsoft Intune to remotely wipe nearly 80,000 devices.
The references include multiple wiper campaigns and destructive malware operations such as NotPetya, SwiftSlicer, AcidRain, AcidPour, and DynoWiper associated with Sandworm/APT44.
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A destructive wiper malware deployed against energy infrastructure to disrupt operations and potentially cause physical consequences.
A destructive wiper malware attributed in the content to ENERGETIC BEAR and hosted on UAE infrastructure.
Wiper malware linked to attacks targeting Poland's energy sector.
Wiper malware used to destroy data on OT/ICS assets including RTUs, protection relays, and HMI workstations during the 2025 Poland Wiper Attacks.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.