Threat intelligence / Malware

LazyWiper

[LazyWiper](https://attack.mitre.org/software/S9039) is a destructive malware observed targeting a manufacturing sector company during the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063). [LazyWiper](https://attack.mitre.org/software/S9039) is a native Windows PowerShell script that is believed to have been generated by a large language model (LLM). [LazyWiper](https://attack.mitre.org/software/S9039) overwrites files on the system using the C# function `WriteRandomBytes()` and can target multiple specific file types by their extensions.(Citation: CERT Polska)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[LazyWiper](https://attack.mitre.org/software/S9039) is a destructive malware observed targeting a manufacturing sector company during the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063). [LazyWiper](https://attack.mitre.org/software/S9039) is a native Windows PowerShell script that is believed to have been generated by a large language model (LLM). [LazyWiper](https://attack.mitre.org/software/S9039) overwrites files on the system using the C# function `WriteRandomBytes()` and can target multiple specific file types by their extensions.(Citation: CERT Polska)

Labels

malware

9 recorded

Relationships

uses

from 2025 Poland Wiper Attacks

Campaign

uses

to Artificial Intelligence

Technique

uses

to Data Destruction

Technique

uses

to Disable or Modify Tools

Technique

uses

to Execution Guardrails

Technique

uses

to File and Directory Discovery

Technique

uses

Technique

uses

to Selective Exclusion

Technique

uses

to System Information Discovery

Technique

2 external

References

mitre-attack

S9039

CERT Polska

https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf