Threat intelligence / Malware

DynoWiper

[DynoWiper](https://attack.mitre.org/software/S9038) is a destructive malware associated with the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063) in December of 2025. [DynoWiper](https://attack.mitre.org/software/S9038) is a native Windows binary that is distributed by a PowerShell script and overwrites files using data generated by the Mersenne Twister algorithm before they are deleted from the system. Multiple variants of [DynoWiper](https://attack.mitre.org/software/S9038) have been identified, with the primary differences being that one variant shuts down the system after completing its destructive operations, and another introduces a time delay between file overwriting and deletion.(Citation: CERT Polska)(Citation: ESET DynoWiper Update JAN 2026)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[DynoWiper](https://attack.mitre.org/software/S9038) is a destructive malware associated with the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063) in December of 2025. [DynoWiper](https://attack.mitre.org/software/S9038) is a native Windows binary that is distributed by a PowerShell script and overwrites files using data generated by the Mersenne Twister algorithm before they are deleted from the system. Multiple variants of [DynoWiper](https://attack.mitre.org/software/S9038) have been identified, with the primary differences being that one variant shuts down the system after completing its destructive operations, and another introduces a time delay between file overwriting and deletion.(Citation: CERT Polska)(Citation: ESET DynoWiper Update JAN 2026)

Labels

malware

10 recorded

Relationships

uses

from 2025 Poland Wiper Attacks

Campaign

uses

to Data Destruction

Technique

uses

to Delay Execution

Technique

uses

to File and Directory Discovery

Technique

uses

to Local Storage Discovery

Technique

uses

to Masquerading

Technique

uses

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Selective Exclusion

Technique

uses

to System Shutdown/Reboot

Technique

3 external

References

mitre-attack

S9038

CERT Polska

https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf

ESET DynoWiper Update JAN 2026

https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/