In this blog post, we provide more technical details related to our previous DynoWiper publication.
Key points of the report:
- ESET researchers identified new data-wiping malware that we have named DynoWiper, used against an energy company in Poland.
- The tactics, techniques, and procedures (TTPs) observed during the DynoWiper incident closely resemble those seen earlier this year in an incident involving the ZOV wiper in Ukraine: Z, O, and V are Russian military symbols.
- We attribute DynoWiper to Sandworm with medium confidence, in contrast to the ZOV wiper, which we attribute to Sandworm with high confidence.
Sandworm profile
Sandworm is a Russia-aligned threat group that performs destructive attacks. It is mostly known for its attacks against Ukrainian energy companies in 2015-12 and 2016-12, which resulted in power outages. In 2017-06 Sandworm launched the NotPetya data-wiping attack that used a supply-chain vector by compromising the Ukrainian accounting software M.E.Doc. In 2018-02, Sandworm launched the Olympic Destroyer data-wiping attack against organizers of the 2018 Winter Olympics in Pyeongchang.
The Sandworm group uses such advanced malware as Industroyer, which is able to communicate with equipment at energy companies via industrial control protocols. In 2022-04, CERT-UA thwarted an attack against an energy company in Ukraine where the Sandworm group tried to deploy a new variant of this malware, Industroyer2.
In 2020-10, the US Department of Justice published an indictment against six Russian computer hackers that it alleges prepared and conducted various Sandworm attacks. The group is commonly attributed to Unit 74455 of the Russian Main Intelligence Directorate (GRU).
History of Sandworm’s destructive operations
Sandworm is a threat actor known for conducting destructive cyberattacks, targeting a wide range of entities including government agencies, logistics companies, transportation firms, energy providers, media organizations, grain sector companies, and telecommunications companies. These attacks typically involve the deployment of wiper malware – malicious software designed to delete files, erase data, and render systems unbootable.
Its operators have a long history of conducting such cyberattacks, and we have documented their activity extensively. In this blogpost, we focus on their recent operations involving data-wiping malware.
To evade detections by security products, Sandworm often modifies the destructive malware it deploys – sometimes by introducing minor changes or by generating newly compiled variants from the original source code, and other times by abandoning a particular wiper altogether and switching to an entirely new malware family for its operations. We rarely see Sandworm attempt to deploy a destructive malware sample that was used in an earlier attack (for example, one with a known hash) or one that is already detected at the time of deployment.
Since February 2022, we have been thoroughly tracking incidents involving destructive malware and have publicly documented our findings in reports such as A year of wiper attacks in Ukraine. Over the years, Sandworm has deployed a wide range of destructive malware families, including, in roughly chronological order, HermeticWiper, HermeticRansom, CaddyWiper, DoubleZero, ARGUEPATCH, ORCSHRED, SOLOSHRED, AWFULSHRED, Prestige ransomware, RansomBoggs ransomware, SDelete-based wipers, BidSwipe, ROARBAT, SwiftSlicer, NikoWiper, SharpNikoWiper, ZEROLOT, Sting wiper, and ZOV wiper. It should be noted that some of these malware families were deployed multiple times across a number of incidents. In 2025, ESET investigated more than 10 incidents involving destructive malware attributed to Sandworm, almost all of them occurring in Ukraine.
We continuously enhance our products to improve early detection of Sandworm operations – ideally identifying activity before destructive wipers are deployed, and whenever possible preventing damage even when previously unknown destructive malware is executed. Because the majority of Sandworm’s cyberattacks currently target Ukraine, we collaborate closely with our Ukrainian partners, including the Computer Emergency Response Team of Ukraine (CERT-UA), to support both prevention and remediation efforts.
Besides Ukraine, Sandworm has a decade-long history of targeting companies in Poland, including those in the energy sector. Typically, these operations have been conducted covertly for cyberespionage purposes, as seen in the BlackEnergy and GreyEnergy cases. Notably, we detected the first deployment of GreyEnergy malware at a Polish energy company back in 2015.
However, since the start of Russia’s full-scale invasion of Ukraine, Sandworm has changed its tactics regarding targets in Poland. Specifically, in October 2022, it carried out a destructive attack against logistics companies in both Ukraine and Poland, disguising the operation as a Prestige ransomware incident. Microsoft Threat Intelligence reported on the Prestige ransomware incidents, which they attributed to Seashell Blizzard (aka Sandworm). At ESET, we detected the Prestige ransomware family and publicly attributed this activity to Sandworm.
In December 2025, we detected the deployment of a destructive malware sample, which we named DynoWiper, at an energy company in Poland. The installed EDR/XDR product, ESET PROTECT, blocked execution of the wiper, significantly limiting its impact in the environment. In this blogpost, we reveal additional details about this activity and outline our attribution process.
CERT Polska did an excellent job investigating the incident and published a detailed analysis in a report available on its website.
DynoWiper
On December 29th, 2025, DynoWiper samples were deployed to the C:\inetpub\pub\ directory, which is likely a shared directory in the victim’s domain, with the following filenames: schtask.exe, schtask2.exe, and <redacted>_update.exe. The schtask*.exe samples contain the PDB path C:\Users\vagrant\Documents\Visual Studio 2013\Projects\Source\Release\Source.pdb. The username vagrant corresponds to a tool called Vagrant, which can be used to manage virtual machines. This suggests that the machine that was used to build the wiper is a Vagrant box or, more likely, a host system that manages virtual machines using Vagrant. It is therefore possible that Sandworm operators first tested the operation on virtual machines before deploying the malware in the target organization.
The attackers initially deployed <redacted>_update.exe (PE timestamp: 2025‑12‑26 13:51:11).
After the initial failure, they made adjustments to the wiper code, compiled it, and then executed schtask.exe (PE timestamp: 2025-12-29 13:17:06). However, this attempt also proved unsuccessful, leading them to rebuild the wiper with some code modifications, resulting in schtask2.exe (PE timestamp: 2025-12-29 14:10:07). It is probable that even this final attempt was unsuccessful. All three versions were deployed on December 29th, 2025, with ESET PROTECT installed on the targeted machines, causing interference with all three variants.
The workflow of DynoWiper is divided into three distinct phases, as detailed in the following sections. The schtask*.exe samples encompass only the first two phases with a five-second delay introduced between them. In contrast,
The wiper utilizes a 16-byte buffer filled with randomly generated data at the start of its execution to overwrite files. Files smaller than 16 bytes are completely overwritten, while smaller files are extended to 16 bytes. To expedite the destruction process, larger files (over 16 bytes) have only certain parts of their contents overwritten.
During the first phase, the malware recursively wipes files on all removable and fixed drives, excluding specific directories such as system32, windows, program files, program files(x86) (missing space before the open bracket), temp, recycle.bin, $recycle.bin, boot, perflogs, appdata, and documents and settings (case-insensitive comparison).
In the second phase, schtask.exe and
The third phase initiates a system reboot, finalizing the system destruction process.
Unlike Industroyer and Industroyer2, DynoWiper samples specifically target the IT environment, with no apparent functionality aimed at operational technology (OT) industrial components. Nevertheless, the presence of such capabilities elsewhere in the attack chain cannot be ruled out.
Additional tools were identified within the same network before the wiper deployment. Initially, the attackers tried to download the Rubeus tool from the path c:\users\
A comparison to the ZOV wiper, attributed to Sandworm with high confidence, reveals similarities in operation with DynoWiper. Notably, the exclusion of specific directories and the distinct logic for wiping smaller and larger files are shared traits. ZOV, previously deployed against a Ukrainian financial institution in November 2025, wipes files on fixed drives, skipping certain directories and overwriting file contents based on size. The ZOV buffer contains the string “ZOV” followed by null bytes, with a system reboot initiated after wiping files.
In a separate ZOV wiper incident at a Ukrainian energy company on January 25th, 2024, the buffer contained the character P instead of “ZOV” and the dropped image resembled a ransom note with a fictitious Bitcoin address.
