dynowiper

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -1,7 +1,7 @@
 name: Executables Or Script Creation In Suspicious Path
 id: a7e3f0f0-ae42-11eb-b245-acde48001122
 version: 23
-date: '2026-02-03'
+date: '2026-02-12'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -44,6 +44,7 @@ search: |
     "*\\Windows\\repair\\*",
     "*\\Windows\\servicing\\*",
     "*Recycle.bin*",
+    "*:\\inetpub\\*"
   )
 
   by Filesystem.action Filesystem.dest Filesystem.file_access_time
@@ -151,6 +152,7 @@ tags:
     - Lokibot
     - Castle RAT
     - SesameOp
+    - DynoWiper
     - XML Runner Loader
   asset_type: Endpoint
   mitre_attack_id:

detections/endpoint/modification_of_wallpaper.yml

@@ -1,7 +1,7 @@
 name: Modification Of Wallpaper
 id: accb0712-c381-11eb-8e5b-acde48001122
-version: 7
-date: '2025-05-02'
+version: 8
+date: '2026-01-12'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -63,6 +63,7 @@ tags:
   - Windows Registry Abuse
   - Black Basta Ransomware
   - Ransomware
+  - ZOVWiper
   asset_type: Endpoint
   mitre_attack_id:
   - T1491

detections/endpoint/rubeus_command_line_parameters.yml

@@ -1,7 +1,7 @@
 name: Rubeus Command Line Parameters
 id: cca37478-8377-11ec-b59a-acde48001122
-version: 9
-date: '2025-10-14'
+version: 10
+date: '2026-02-12'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -80,6 +80,7 @@ tags:
   - Active Directory Kerberos Attacks
   - BlackSuit Ransomware
   - Scattered Lapsus$ Hunters
+  - ZOVWiper
   asset_type: Endpoint
   mitre_attack_id:
   - T1550.003

detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml

@@ -1,7 +1,7 @@
 name: Rubeus Kerberos Ticket Exports Through Winlogon Access
 id: 5ed8c50a-8869-11ec-876f-acde48001122
-version: 10
-date: '2025-10-14'
+version: 11
+date: '2026-02-12'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -65,6 +65,7 @@ tags:
   - Active Directory Kerberos Attacks
   - BlackSuit Ransomware
   - Scattered Lapsus$ Hunters
+  - ZOVWiper
   asset_type: Endpoint
   mitre_attack_id:
   - T1550.003

detections/endpoint/windows_high_file_deletion_frequency.yml

@@ -1,7 +1,7 @@
 name: Windows High File Deletion Frequency
 id: 45b125c4-866f-11eb-a95a-acde48001122
-version: 10
-date: '2025-09-18'
+version: 11
+date: '2026-02-12'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
 type: Anomaly
@@ -80,6 +80,8 @@ tags:
   - Interlock Ransomware
   - NailaoLocker Ransomware
   - APT37 Rustonotto and FadeStealer
+  - DynoWiper
+  - ZOVWiper
   asset_type: Endpoint
   mitre_attack_id:
   - T1485

detections/endpoint/windows_indicator_removal_via_rmdir.yml

@@ -1,7 +1,7 @@
 name: Windows Indicator Removal Via Rmdir
 id: c4566d2c-b094-48a1-9c59-d66e22065560
-version: 7
-date: '2025-09-18'
+version: 8
+date: '2026-02-12'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -64,6 +64,7 @@ tags:
   analytic_story:
   - DarkGate Malware
   - APT37 Rustonotto and FadeStealer
+  - ZOVWiper
   asset_type: Endpoint
   mitre_attack_id:
   - T1070

detections/endpoint/windows_system_shutdown_commandline.yml

@@ -1,7 +1,7 @@
 name: Windows System Shutdown CommandLine
 id: 4fee57b8-d825-4bf3-9ea8-bf405cdb614c
-version: 10
-date: '2025-10-14'
+version: 11
+date: '2026-02-12'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -72,6 +72,7 @@ tags:
   - DarkCrystal RAT
   - MoonPeak
   - Scattered Lapsus$ Hunters
+  - ZOVWiper
   asset_type: Endpoint
   mitre_attack_id:
   - T1529

stories/dynowiper.yml

@@ -0,0 +1,18 @@
+name: DynoWiper
+id: 46eceaa1-8d16-4ebd-848d-d8c1816bb1a0
+version: 1
+status: production
+date: '2026-02-12'
+author: Teoderick Contreras, Splunk
+description: DynoWiper is a newly documented data-wiping malware identified by ESET researchers during a destructive cyber incident targeting an energy company in a critical infrastructure. Designed to overwrite files and force a system reboot, DynoWiper erases data across removable and fixed drives, rendering systems inoperable if unprotected. ESET attributes the malware to the Russia-aligned threat group Sandworm with medium confidence, noting shared tactics and coding patterns with previous destructive wiper families like ZOV. Endpoint defenses successfully blocked execution, highlighting the need for robust detection.
+narrative: In late December 2025, ESET responded to a destructive malware incident involving a previously unseen wiper dubbed DynoWiper deployed within an energy sector environment. Analysis revealed a dedicated file-overwriting payload that systematically targeted drives and rebooted systems to complete destruction. Drawing parallels to prior Sandworm wiper operations such as ZOV. 
+references:
+  - https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/
+tags:
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

stories/zovwiper.yml

@@ -0,0 +1,18 @@
+name: ZOVWiper
+id: 3dfd6bc2-8f98-42dd-945c-d6ab5995a3e4
+version: 1
+date: '2026-02-12'
+author: Teoderick Contreras, Splunk
+status: production
+description: ZOVWiper is a destructive data-wiping malware identified by ESET researchers, attributed to the threat group Sandworm with high confidence. First observed in November 2025 targeting a financial institution and later in an energy sector incident, ZOVWiper systematically iterates over fixed drives and overwrites file contents to destroy data irrecoverably. The malware skips key system directories and uses size-based overwrite logic to maximize destructive impact. Its deployment highlights ongoing destructive operations against critical infrastructure and financial entities.
+narrative:  In late 2025, ESET researchers uncovered ZOVWiper during incident response to a destructive malware attack against a financial organization. ZOVWiper’s core function is to traverse all fixed drives, selectively overwrite file contents based on size, and render systems inoperable—a characteristic pattern tied to destructive campaigns by Sandworm. The malware’s directory exclusions and wiping methodology were later noted as technical parallels to other destructive tools such as DynoWiper, reinforcing attribution confidence. ZOVWiper’s operational use against both financial and energy sector targets underscores sustained threat actor focus on disrupting critical functions through targeted data destruction.
+references:
+- https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/
+tags:
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection