New Lotus data wiper used against Venezuelan energy, utility firms
Previously undocumented Lotus data wiper targets Venezuelan energy and utility firms.
A new data-wiping malware called Lotus was discovered by Kaspersky being used in targeted attacks against energy and utilities organizations in Venezuela in 2025. The malware uses batch scripts to disable defenses and network interfaces before executing a low-level wiper that overwrites physical drives, clears recovery mechanisms, and eliminates file recovery options. The timing and targeting align with geopolitical tensions in the region, including the December 2025 cyberattack on Venezuelan state oil company PDVSA.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Kaspersky?
Get an email when a new story names Kaspersky, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Lotus malware attack demonstrates how sophisticated threat actors can bypass security controls and cause irreversible damage to critical infrastructure systems. The malware's ability to disable defenses, destroy recovery mechanisms, and overwrite physical drives highlights the catastrophic impact when organizations lack robust incident response capabilities and resilient backup systems. This attack pattern is particularly concerning for energy and utility sectors, where data destruction can disrupt essential services and compromise public safety.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Lotus
- malware — OhSyncNow.bat
- malware — notesreg.bat