MITRE ATT&CKsoftware (malware)
S9038 DynoWiper
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2026-04-22
Description
DynoWiper is a destructive malware associated with the 2025 Poland Wiper Attacks in December of 2025. DynoWiper is a native Windows binary that is distributed by a PowerShell script and overwrites files using data generated by the Mersenne Twister algorithm before they are deleted from the system. Multiple variants of DynoWiper have been identified, with the primary differences being that one variant shuts down the system after completing its destructive operations, and another introduces a time delay between file overwriting and deletion.
Related
Uses · MITRE ATT&CK (9)
- T1679 Selective Exclusion technique
- T1680 Local Storage Discovery technique
- T1678 Delay Execution technique
- T1529 System Shutdown/Reboot technique
- T1485 Data Destruction technique
- T1036 Masquerading technique
- T1083 File and Directory Discovery technique
- T1106 Native API technique
- T1120 Peripheral Device Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- C0063 2025 Poland Wiper Attacks campaign