DynoWiper
- ID
- S9038
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 24 Apr 2026
DynoWiper is a destructive malware associated with the 2025 Poland Wiper Attacks in December of 2025. DynoWiper is a native Windows binary that is distributed by a PowerShell script and overwrites files using data generated by the Mersenne Twister algorithm before they are deleted from the system. Multiple variants of DynoWiper have been identified, with the primary differences being that one variant shuts down the system after completing its destructive operations, and another introduces a time delay between file overwriting and deletion.[1][2]
Techniques used (9)
- T1036 Masquerading
- T1083 File and Directory Discovery
- T1106 Native API
- T1120 Peripheral Device Discovery
- T1485 Data Destruction
- T1529 System Shutdown/Reboot
- T1678 Delay Execution
- T1679 Selective Exclusion
- T1680 Local Storage Discovery