MITRE ATT&CKsoftware (malware)
S9039 LazyWiper
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2026-04-22
Description
LazyWiper is a destructive malware observed targeting a manufacturing sector company during the 2025 Poland Wiper Attacks. LazyWiper is a native Windows PowerShell script that is believed to have been generated by a large language model (LLM). LazyWiper overwrites files on the system using the C# function `WriteRandomBytes()` and can target multiple specific file types by their extensions.
Related
Uses · MITRE ATT&CK (8)
- T1685 Disable or Modify Tools technique
- T1679 Selective Exclusion technique
- T1588.007 Artificial Intelligence sub-technique
- T1059.001 PowerShell sub-technique
- T1485 Data Destruction technique
- T1480 Execution Guardrails technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- C0063 2025 Poland Wiper Attacks campaign