[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fi45uA135q8tQK_FswXkkPJRLEzv39oDpTcFuA5q7uQQ":3},{"article":4,"iocs":45,"watch_terms":55,"solutions":56,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"00d712d3-df32-4c00-89b9-d9d1660cf89a","New Lotus data wiper used against Venezuelan energy, utility firms","new-lotus-data-wiper-used-against-venezuelan-energy-utility-firms-f1d46e","A previously undocumented data-wiping malware dubbed Lotus was used last year in targeted attacks against energy and utilities organizations in Venezuela. [...]","A new data-wiping malware called Lotus was discovered by Kaspersky being used in targeted attacks against energy and utilities organizations in Venezuela in 2025. The malware uses batch scripts to disable defenses and network interfaces before executing a low-level wiper that overwrites physical drives, clears recovery mechanisms, and eliminates file recovery options. The timing and targeting align with geopolitical tensions in the region, including the December 2025 cyberattack on Venezuelan state oil company PDVSA.","Previously undocumented Lotus data wiper targets Venezuelan energy and utility firms.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-lotus-data-wiper-used-against-venezuelan-energy-utility-firms\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F04\u002F21\u002Flotus.jpg","2026-04-21T18:38:40+00:00","2026-04-21T20:00:21.806707+00:00",8,[17,20],{"name":18,"type":19},"Kaspersky","vendor",{"name":21,"type":19},"Petróleos de Venezuela (PDVSA)","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":22,"icon":24,"name":25,"slug":26},null,"Malware","malware",[28,33,35,40],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":34},{"id":22,"icon":24,"name":25,"slug":26},{"category":36},{"id":37,"icon":24,"name":38,"slug":39},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,49,52],{"type":26,"value":47,"context":48},"Lotus","Data-wiping malware targeting Venezuelan energy and utility organizations",{"type":26,"value":50,"context":51},"OhSyncNow.bat","First-stage batch script that disables UI0Detect service and coordinates execution",{"type":26,"value":53,"context":54},"notesreg.bat","Second-stage batch script that disables accounts, network interfaces, and clears logins",[18,21],{"controls":57,"vendors":145},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":88,"name":89,"problem":90,"products":91},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"slug":117,"name":118,"problem":119,"products":120},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":157},"destructive-lotus-wiper-targets-critical-infrastructure-with-defense-evasion","Destructive Lotus Wiper Targets Critical Infrastructure with Defense Evasion","The Lotus malware attack demonstrates how sophisticated threat actors can bypass security controls and cause irreversible damage to critical infrastructure systems. The malware's ability to disable defenses, destroy recovery mechanisms, and overwrite physical drives highlights the catastrophic impact when organizations lack robust incident response capabilities and resilient backup systems. This attack pattern is particularly concerning for energy and utility sectors, where data destruction can disrupt essential services and compromise public safety.",[151,152,153,154,155,156],"CIS Control 11","CIS Control 8","NIST IR-4","NIST CP-9","NIST CP-10","IEC 62443-3-3",{}]