defection.io

malware

DynoWiper S9038

Type: malware
Platform: Windows
Created: 22 April 2026
Last modified: 23 April 2026

DynoWiper is a destructive malware associated with the 2025 Poland Wiper Attacks in December of 2025. DynoWiper is a native Windows binary that is distributed by a PowerShell script and overwrites files using data generated by the Mersenne Twister algorithm before they are deleted from the system. Multiple variants of DynoWiper have been identified, with the primary differences being that one variant shuts down the system after completing its destructive operations, and another introduces a time delay between file overwriting and deletion.[1][2]

Techniques44th pct

Tactics32nd pct

Threat groupsNone recorded

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

malware

DynoWiper S9038

Type: malware
Platform: Windows
Created: 22 April 2026
Last modified: 23 April 2026

Techniques44th pct

Tactics32nd pct

Threat groupsNone recorded

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

DynoWiper MITRE reference S9038

Masquerading T1036 ↗

DynoWiper has been named after well-known files schtask.exe, schtask2.exe, and <redacted>_update.exe.3 4

Stealth53 detection rules

File and Directory Discovery T1083 ↗

DynoWiper has used the Microsoft Windows native FindFirstFile() and FindNextFile() to recursively enumerate directories and files on the system.5

Discovery29 detection rules

Native API T1106 ↗

DynoWiper has used multiple native Windows functions, such as GetLogicalDrives and FindNextFile for discovery and file deletion.6 7

Execution14 detection rules

Peripheral Device Discovery T1120 ↗

DynoWiper has enumerated and overwritten files on all removeable and fixed drives.8

Discovery2 detection rules

Data Destruction T1485 ↗

DynoWiper has overwritten files with 16-byte sequences of random data generated by the Mersenne Twister algorithm using the Microsoft Windows native CreateFileW() function to open the file and the SetFilePointerEx() and WriteFile() functions to overwrite the file.9 Additionally, versions of DynoWiper can also delete files using the DeleteFileW API.10

Impact56 detection rules

System Shutdown/Reboot T1529 ↗

DynoWiper has used the Microsoft Windows native ExitWindowsEx() function to log off the interactive user and shutdown the system.11

Impact16 detection rules

Standing S9038

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques944th pct

44th percentile · 56% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics432nd pct

32nd percentile · 68% of 825 ATT&CK software entries have more tactics spanned.

Threat groups061% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaign185% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique14med29th pct

29th percentile · 71% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique4med28th pct

28th percentile · 72% of 825 ATT&CK software entries have more atomic tests per technique.

Data comps / technique3med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique0medBottom 17%

17th percentile · 83% of 825 ATT&CK software entries have more mitigations per technique.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 9 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 109Splunk ESCU (cumulative) · 61