Lotus wiper malware targets Venezuelan infrastructure

A previously undocumented data-wiping malware named Lotus was deployed against Venezuelan energy and utility organizations in late 2025. The malware operates in stages, using batch scripts to disable security features before deploying a payload that overwrites physical drives, clears recovery points, and systematically destroys files to render systems unrecoverable. Kaspersky researchers note that Lotus's low-level disk operations and multiple overwrite cycles indicate sophisticated design aimed at permanent data destruction. The attacks coincide with a mid-December cyberattack on state oil company PDVSA that disrupted delivery systems.