DynoWiperMalware
DynoWiper is a destructive malware associated with the 2025 Poland Wiper Attacks in December of 2025. DynoWiper is a native Windows binary that is distributed by a PowerShell script and overwrites files using data generated by the Mersenne Twister algorithm before they are deleted from the system.From MITRE ATT&CK
Last reported 28 days ago, by CERT-EU4 reports
ATT&CK techniques
6 of 19 · each with the sentence it comes from- T1003OS Credential Dumping
“OS Credential Dumping: LSASS Memory”
- T1003.001LSASS Memory
“T1003.001”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
- T1053.005Scheduled Task
“T1053.005”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
- T1059.001PowerShell
“T1059.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Cyber Brief 26-02 - January 2026“On December 29, 2025, renewable energy operators in Poland experienced an attempted cyberattack using data-wiping malware, dubbed DynoWiper by ESET.”
-
This month in security with Tony Anscombe – May 2026 edition“… and systems exposed directly to the internet – were the same as those used in attacks against the Polish energy sector that leveraged DynoWiper described by ESET researchers here.”
-
DynoWiper update: Technical analysis and attribution“DynoWiper update: Technical analysis and attribution”
-
ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025“…hile, the attack on Poland’s power grid in the last week of December involved data-wiping malware that ESET has now analyzed and named DynoWiper.”
Indicators in its reports
named in the reports above- 4ec3c90846af6b79…3fd21f6d4cf6in 2 reports
- 31.172.71[.]5in 1 report
- progamevl[.]ruin 1 report
- 472ca448f82a7ff6…86fd7c38b631in 1 report
- 4f8e9336a784a196…8fa54f6a92e2in 1 report
- 86596a5c5b05a8bf…4702f7d0d61bin 1 report
- 69ede7e341fd26fa…80cb44778d93in 1 report
- 9ec4c38394ea2048…6de48d8bd4e8in 1 report
- 410c8a57fe6e09ed…e4797ca80a19in 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.