Threat Intel
DynoWiper: New Data‑Wiping Malware Targets Polish Energy Company, Likely Sandworm
ESET researchers uncovered a data‑wiping incident at a Polish energy company, deploying DynoWiper that erased critical files. The attack mirrors the ZOV wiper and is attributed to the Russian‑aligned Sandworm group. Defenders should back up, isolate, and monitor for similar deletion patterns.
What happened
On 30 Jan 2026, ESET researchers uncovered a data‑wiping incident at a Polish energy company. The attackers deployed a new wiper, dubbed DynoWiper, that erased critical files and left the system unusable.
Impact
The malware targeted the company’s operational technology stack, wiping configuration files and backup archives. The attack mirrors the tactics of the ZOV wiper used earlier in Ukraine, suggesting a similar threat actor.
Attribution
ESET attributes DynoWiper to the Russian‑aligned Sandworm group with medium confidence. Sandworm has a history of destructive attacks against energy infrastructure, including the 2017 NotPetya and 2018 Olympic Destroyer incidents.
Defender actions
- Verify and restore from recent, offline backups.
- Isolate affected systems and block known Sandworm command‑and‑control domains.
- Deploy endpoint detection that flags file‑deletion patterns and anomalous process execution.
- Apply the latest patches for industrial control protocols and operating systems.
- Conduct a thorough forensic analysis to identify persistence mechanisms.
Related articles
DYNOWIPER Wiper Attack on Poland’s Energy Infrastructure: What SecOps Need to Know
A coordinated destructive campaign on 29 Dec 2025 deployed the DYNOWIPER wiper against Poland’s renewable energy farms and a major CHP plant, wiping data from Windows systems. Defenders must patch exposed Fortinet devices, enforce MFA, and deploy canary file monitoring to detect and stop the malware.
Read briefing
CenterPoint Energy Breach: 7.5 Million Customer Records Exposed via Unsecured Public API
Houston‑based utility CenterPoint Energy confirmed that an attacker stole and leaked 7.49 million customer records, including names, phone numbers, addresses, account numbers, billing amounts and partial SSNs. The intruder accessed the data by repeatedly querying a public API that lacked rate limiting, a web application firewall and other safeguards. CenterPoint has filed with the SEC, is working with third‑party experts, and has already faced class‑action lawsuits. The company reports that electric and gas services remain unaffected and believes the breach will not materially impact its finan
Read briefing
LinkedIn Introduces Verification Checks to Counter AI‑Generated Fake Profiles
LinkedIn has rolled out new verification mechanisms—peer‑vouching, company‑page controls, and workplace email validation—to make fabricated professional identities harder to create. Defenders should cross‑reference hires against LinkedIn’s verified data and enforce workplace email verification before granting internal access.
Read briefing
PhantomRaven: JavaScript Info Stealer Developed by Bug‑Bounty Threat Actor
CrowdStrike uncovered PhantomRaven, a JavaScript‑based information stealer created by a financially motivated threat actor who operates as a bug‑bounty hunter. The malware targets web applications, harvesting credentials and sensitive data via injected scripts. Defenders should inspect client‑side code, enforce strict CSP, and monitor for anomalous JavaScript activity.
Read briefing