What is wiperware and why is energy the primary target?
Wiperware is a class of destructive malware designed solely to destroy data and systems. Unlike ransomware, wiperware gives victims no chance to recover their data — its purpose is maximum destruction of IT and OT infrastructure.
The energy sector is particularly vulnerable to wiperware attacks for several reasons. First, energy infrastructure is a strategic target in geopolitical conflicts. Second, SCADA and ICS systems often run on legacy software with limited protection mechanisms. Third, destroying control systems in the energy sector can have catastrophic cascading effects on the entire economy.
The DynoWiper attack on Polish energy infrastructure
In December 2025, Polish energy companies fell victim to the DynoWiper attack — one of the most sophisticated wiperware attacks targeting European energy infrastructure. This attack served as a serious warning for the entire industry.
DynoWiper employed a multi-stage attack chain. Initial access was gained through a compromised VPN account belonging to a service technician. Attackers then spent weeks conducting reconnaissance, mapping the IT and OT network topology. During the destruction phase, the wiperware simultaneously overwrote PLC controller firmware, destroyed SCADA configuration data, and erased system logs to hinder forensic analysis.
The attack’s impact included temporary disruptions to energy grid monitoring systems and the need to switch to manual control mode in some facilities. Full system recovery required weeks of work.
Wiperware destruction mechanisms in OT environments
Wiperware in energy environments operates on multiple levels simultaneously, making it particularly dangerous.
At the IT level, it targets SCADA servers, process historians, and backup systems. It overwrites disk partition tables, destroys bootloaders, and encrypts configuration files without leaving a decryption key.
At the OT level, it targets PLC and RTU controller firmware. It manipulates configuration parameters, sets incorrect setpoint values, and disables safety instrumented systems. In the worst-case scenario, it can cause physical equipment damage — similar to how Stuxnet destroyed centrifuges at Natanz.
At the communication level, it destroys network switch configurations, modifies routing tables, and blocks OT protocols (Modbus TCP, DNP3, IEC 104), isolating operators from controlled processes.
Evolution of wiperware — from NotPetya to DynoWiper
The history of wiperware in the energy sector dates back to 2015, when BlackEnergy attacked the Ukrainian power grid, causing a blackout for 230,000 customers. In 2016, Industroyer (CrashOverride) directly manipulated energy protocols IEC 104 and IEC 61850.
In 2017, NotPetya, while officially ransomware, was effectively a wiper — its encryption mechanism was deliberately irreversible. In 2022, AcidRain attacked Viasat satellite terminals, disrupting communications in the energy sector. WhisperGate and HermeticWiper targeted Ukrainian critical infrastructure.
DynoWiper from 2025 represents a new generation — it combines IT and OT-level destruction, uses living-off-the-land techniques, and can adapt to the discovered industrial network topology.
Protection strategies against wiperware in energy
Protecting against wiperware requires a multi-layered approach encompassing both prevention and resilience.
IT/OT segmentation forms the first line of defense. Implementing security zones aligned with the Purdue model (IEC 62443) with an industrial DMZ between IT and OT networks. Traffic control at the OT protocol level using industrial firewalls. Separating safety networks from control networks.
Offline backup and recovery is a critical resilience component. Regular backups of PLC and RTU controller configurations on offline media. Documentation of OT network topology and configuration parameters in physical form. Recovery exercises at least quarterly with Recovery Time Objective (RTO) measurement.
OT anomaly monitoring enables early detection. Continuous network traffic monitoring in OT segments using tools that understand industrial protocols. Detection of unauthorized firmware and controller configuration changes. Event correlation from IT and OT systems in a unified SOC.
Industrial system hardening reduces the attack surface. Disabling unused ports and services on controllers. Protecting access to PLC programming mode. Regular firmware updates with integrity verification.
Wiperware incident response plan
A wiperware scenario in the energy sector requires a specialized incident response plan that accounts for OT-specific considerations.
During the detection phase, recognizing destruction patterns is critical — mass disk overwriting, unauthorized firmware changes, loss of communication with controllers. Automatic alerts from OT monitoring should immediately escalate to the IR team.
During containment, the priority is isolating infected segments while maintaining continuity of critical energy processes. Switching to manual control or redundant safety systems. Securing logs and forensic evidence before they are destroyed.
During recovery, leveraging offline controller configuration backups. Verifying firmware integrity before restart. Gradually restoring automation with continuous monitoring.
How nFlo helps protect energy from wiperware
nFlo provides comprehensive support for protecting energy infrastructure against wiperware threats.
OT/ICS security audits identify gaps in IT/OT segmentation, assess resilience against destructive attacks, and verify backup/restore procedure readiness.
SOC as a Service with OT protocol monitoring detects anomalies indicating early wiperware attack phases — reconnaissance, lateral movement, and controller access attempts.
Incident Response provides ready response scenarios for wiperware attacks in energy environments, accounting for SCADA system specifics and energy supply continuity requirements.
Red Team conducts controlled attack simulations on OT/IT infrastructure, verifying security effectiveness and security team response times.
Schedule a free consultation — we’ll assess your energy infrastructure’s resilience against wiperware attacks.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
