Dynowiper Exposed: Forensic Analysis of a Sandworm Cyberweapon

Background

On 29 December 2025, during severe winter weather, a coordinated destructive campaign hit Poland’s energy sector, 30+ wind and solar farms and a combined heat-and-power (CHP) plant supplying nearly half a million customers, plus an opportunistically targeted manufacturer. The payload was DYNOWIPER, a custom wiper built to irreversibly destroy data. CERT Polska attributes the infrastructure to the cluster tracked as Static Tundra (Cisco), Berserk Bear (CrowdStrike), Ghost Blizzard (Microsoft) and Dragonfly (Symantec), a long-running Russia-nexus actor with a history of targeting energy and ICS.

Initial access came through internet-exposed FortiGate VPNs that allowed authentication without MFA, plus reused credentials across facilities and unpatched historical vulnerabilities. After months of reconnaissance against SCADA/OT networks, exfiltrating Active Directory databases and FortiGate configurations. The actor deployed the wiper. Our sample is confirmed DYNOWIPER: its SHA-256 matches Elastic Security Labs’ published IOC set (the ‘schtask.exe’ entry), and the 167,424-byte file size and ‘C:\Users\vagrant’ PDB path corroborate the identification.

What we observed

Stripped to essentials, DYNOWIPER is fast and single-purpose:

• Data destruction, not encryption: it seeds a Mersenne Twister PRNG and overwrites each file’s first 16 bytes, then, for larger files, up to 4,096 random 16-byte offsets. Headers and scattered content are destroyed, making recovery impossible; there is no ransom note and no key.
• Drive targeting with exclusions: it enumerates all A-Z drives via GetLogicalDrives() and hits fixed and removable media, but skips windows, system32, program files, boot, appdata and $recycle.bin so the host stays alive long enough to finish wiping.
• Forced reboot: after corruption it enables SeShutdownPrivilege and calls ExitWindowsEx(EWX_REBOOT | EWX_FORCE) to tip the machine over (version A; CERT Polska’s version B drops the reboot and adds a 5-second sleep between corruption and deletion).
• Deliberately unsophisticated: Elastic and CERT Polska found NO persistence, NO C2 callbacks, NO shell commands and NO anti-analysis. That directly contradicts the automated triage’s anti-debug / anti-VM / ‘sophisticated multi-stage’ flags on this sample, which should be treated as false positives. The one notable artefact is the PDB path C:\Users\vagrant\Documents\Visual Studio 2013\…\Source.pdb, indicating a Vagrant-managed build VM.

DYNOWIPER execution chain

A wiper, not ransomware: corruption is irreversible and there is no decryptor, offline, air-gapped backups are the only recovery.

Attribution

CERT Polska attributes the campaign infrastructure to the cluster known as Static Tundra / Berserk Bear / Ghost Blizzard / Dragonfly, a Russia-nexus actor historically focused on energy and industrial control systems. Confidence in the malware identification is high (our sample’s SHA-256 is in Elastic’s DYNOWIPER IOC set, with matching file size and PDB path); the actor attribution follows CERT Polska’s reporting rather than an independent Alpha Cyber determination. DYNOWIPER itself is described as ‘not technically sophisticated’, its effectiveness came from the actor’s extensive pre-positioned access, not from the wiper’s tradecraft.

Confidence: 88%.

DYNOWIPER isn’t clever, it’s fast, irreversible, and aimed at the lights. Simplicity was the point.

Tactics, techniques & procedures (MITRE ATT&CK)

Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:

Indicators of compromise

Defenders can block or hunt the following:

Detection

Copy-ready hunting query:

# DYNOWIPER sample hashes (this analysis + Elastic / CERT Polska IOC set)
index=edr sha256 IN ("d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160","835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5","65099f306d27c8bcdd7ba3062c012d2471812ec5e06678096394b238210f0f7c","60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b")
| stats count values(host) as hosts by process_name, parent_process

# Behavioural hunts (higher value than any hash -- DYNOWIPER has no C2 or persistence):
# 1) GetLogicalDrives() followed by high-volume CreateFileW read/write across fixed + removable drives
# 2) SetFileAttributesW setting FILE_ATTRIBUTE_NORMAL at scale, immediately before file writes
# 3) SeShutdownPrivilege enabled, then ExitWindowsEx(EWX_REBOOT|EWX_FORCE)
# 4) GPO changes creating SYSTEM-privileged scheduled tasks (T1053.005) pushing *.exe to many hosts
# 5) Simultaneous unusual file modifications across multiple drives

# CERT Polska YARA (data-destruction strings + shutdown API):
rule DYNOWIPER { strings: $a="$recycle.bin" wide $p="SeShutdownPrivilege" wide $x="ExitWindowsEx" $g="GetLogicalDrives" condition: uint16(0)==0x5A4D and filesize<500KB and $p and 2 of ($x,$g,$a) }

Recommendations

• Treat as destructive: restore from offline / air-gapped backups (verify integrity first). There is no decryptor, and online or networked backups may have been targeted.
• Deploy behavioural wiper/ransomware protection such as canary-file monitoring; CERT Polska reports canary technology halted overwriting on 100+ machines mid-execution, where signatures alone would have missed a novel wiper.
• Enforce MFA on all VPN and remote-access solutions and audit FortiGate/edge devices for unauthorized accounts, rules and scheduled tasks; reset credentials, especially domain admin, and assume compromise.
• Hunt the behaviours, not just the hashes: GetLogicalDrives -> mass file operations, SetFileAttributesW(NORMAL) at scale, SeShutdownPrivilege -> ExitWindowsEx, and GPO-created SYSTEM scheduled tasks distributing executables.
• Block the published hashes, monitor the CERT Polska/Elastic IP set, and deploy the DYNOWIPER YARA rule; review default credentials on industrial devices (RTUs, HMIs, serial servers).