ESET researchers have identified DynoWiper, a new destructive data-wiping malware. The analyzes show strong similarities with the ZOV wiper, already observed in Ukraine. Based on its analysis, ESET attributes the attack to the pro-Russian threat group Sandworm
Researchers of ESET, a global leader in the cybersecurity market, have identified a new destructive data-wiping malware, called DynoWiper, that was used in an attack against an energy company in Poland. The tactics, techniques and procedures (TTPs) observed during the incident bear strong similarities to those already found in a previous attack involving the ZOV wiper in Ukraine: Z, O and V are Russian military symbols. Based on its analysis, ESET Research assigns DynoWiper to the pro-Russian threat group Sandworm with a medium confidence level.
This is a rare and so far undocumented case of the use of destructive malware by a Russian-aligned actor against an energy company in Poland. During 2025, ESET analyzed more than ten incidents involving destructive malware attributed to Sandworm, almost all of which occurred in Ukraine.
The installed EDR/XDR solution, ESET PROTECT, blocked the wiper from running, significantly limiting its impact on the affected environment. CERT Polska (the Polish national Computer Emergency Response Team) carried out extensive work in analyzing the incident and published a report detailed, available on its website.
On December 29, 2025, some variant of DynoWiper was deployed in what was most likely a shared directory of the victim's domain. It is possible that Sandworm's operators initially tested the operation on virtual machines before deploying the malware within the target organization. Three distinct variants were deployed and all attempts failed. The wiper overwrites files using a 16-byte buffer containing random data generated only once at execution startup. On an unprotected system, files that are 16 bytes or less in size are completely overwritten. To speed up the shredding process, only part of the content is overwritten in files larger than 16 bytes. DynoWiper erases files present on all removable and fixed drives and finally forces the system to reboot, which concludes the destruction process.
Unlike other malware attributed to Sandworm, including Industroyer and Industroyer2, the recently discovered DynoWiper samples are focused exclusively on the IT environment, with no evidence of functionality targeting industrial OT components. However, this evidence does not exclude that such capabilities may have been present in other phases of the attack chain.
ESET Research has identified several similarities to known destructive malware, particularly the ZOV wiper, which ESET gives Sandworm a high level of trust. DynoWiper operates very similarly to ZOV. In particular, the exclusion of some directories and the clear logical distinction in the code between the deletion of small and large files are elements common to both wipers. ZOV is a destructive malware detected during an attack on a financial institution in Ukraine in November 2025. Once executed, the wiper cycles through files on all fixed drives and erases their contents by overwriting them. An additional case of ZOV use involved a Ukrainian energy company, which was hit on January 25, 2024.
Sandworm is a Russia-aligned threat group known for conducting destructive attacks against a wide range of organizations, including government entities, logistics companies, transportation operators, energy providers, media, grain companies, and telecommunications operators. These operations generally involve the use of wipers, malware designed to delete files, erase data and make systems unusable.
In addition to Ukraine, the group has a decades-long history of hostile activity against companies in Poland, including those in the energy sector. In October 2022, Sandworm conducted a destructive attack against logistics companies in both Ukraine and Poland, disguising the operation as a Prestige ransomware attack (which simulates an extortion attack but is designed to render systems unusable), when in reality the goal was sabotage. As the majority of the group's cyber operations are currently aimed against Ukraine, ESET works closely with local partners, including CERT-UA, to support incident prevention and response activities.
