DYNOWIPER Returns With New Tactics and Attribution Clues

New analysis of the DynoWiper malware shows a continued evolution in destructive wiper operations. Updated samples demonstrate refined execution logic, expanded system targeting, and clearer links to coordinated destructive campaigns. Research published by ESET provides deeper insight into how DynoWiper operates at a low level and how attackers deploy it in targeted environments.

DynoWiper is not designed for espionage or monetization. Its sole objective is irreversible system destruction.

Infection and Execution Flow

DynoWiper is typically deployed post-compromise, after attackers already gain administrative access to the target environment.

Common deployment characteristics include:

• Executed manually or via attacker controlled scripts
• Requires Administrator or SYSTEM privileges
• Often launched using cmd.exe or powershell.exe
• Observed execution path examples:
  • C:\Windows\Temp\dynowiper.exe
  • C:\ProgramData\svc.exe

Once executed, the malware does not attempt persistence. Instead, it immediately begins destructive routines.

Core Wiper Functionality

DynoWiper focuses on rendering the system permanently unusable by targeting both user data and operating system components.

Key destructive behaviors include:

• Overwriting files with random or fixed data buffers
• Deleting volume shadow copies using:
  • vssadmin delete shadows /all /quiet
• Disabling recovery options:
  • bcdedit /set {default} recoveryenabled No
• Corrupting system directories such as:
  • C:\Windows\System32
  • C:\Users\
• Triggering forced reboot to finalize damage

The malware does not attempt data exfiltration or encryption.

Notable Technical Characteristics

DynoWiper samples analyzed show consistent low level implementation choices:

• Written in C/C++
• Uses direct Windows API calls for file handling
• No network communication or command and control
• Minimal obfuscation, indicating confidence in execution context
• Hard coded logic rather than configuration driven behavior

This design reduces runtime dependencies and lowers the chance of execution failure.

Attribution and Operational Context

ESET researchers assess DynoWiper as part of a targeted destructive campaign rather than opportunistic malware. The tooling, access requirements, and execution timing suggest use by a motivated threat actor with prior access to victim networks.

The malware’s deployment aligns with politically or strategically motivated disruption rather than criminal activity.

Technical Summary Table

Defensive Considerations

To reduce DynoWiper impact, defenders should:

• Monitor for abuse of vssadmin and bcdedit
• Alert on unexpected wiper like file overwrite behavior
• Restrict administrative access paths
• Segment critical systems to limit blast radius

DynoWiper reinforces the continued relevance of destructive malware in modern threat operations, especially when attackers prioritize disruption over stealth.