malware

LazyWiper S9039

Type: malware
Platform: Windows
Created: 22 April 2026
Last modified: 12 May 2026

LazyWiper is a destructive malware observed targeting a manufacturing sector company during the 2025 Poland Wiper Attacks. LazyWiper is a native Windows PowerShell script that is believed to have been generated by a large language model (LLM). LazyWiper overwrites files on the system using the C# function WriteRandomBytes() and can target multiple specific file types by their extensions.[1]

Techniques38th pct

Tactics53rd pct

Threat groupsNone recorded

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S9039

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects the use of commands to add or set exclusions in Windows Defender. It (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Nasreddine Bencherchali, Splunk	2021-11-25	2026-06-08	773b66fe-4dd9-11ec-8289-acde48001122
	Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-09-02	2024-03-19	d7662ff6-9e97-4596-a61d-9839e32dee8d
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
	Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts	Generic	test	ps_script	windows	PowerShell	Defense Impairment Disable or Modify Tools	-	high	Florian Roth (Nextron Systems)	2022-11-09	—	e0d6c087-2d1c-47fd-8799-3904103c5a98
	Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...)	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-12-25	—	aa37cbb0-da36-42cb-a90f-fdf216fc7467
	Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	@kostastsale, Nasreddine Bencherchali (Nextron Systems)	2023-11-05	2024-08-16	31e124fb-5dc4-42a0-83b3-44a69c77b271
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use (...)	Generic	experimental	process_creation	linux	Linux Auditd	Defense Impairment Disable or Modify Tools Privilege Escalation, Stealth Process Injection Proc Memory	-	high	Milad Cheraghi	2025-05-26	2025-12-05	e497a24e-9345-4a62-9803-b06d7d7cb132
	Detect changes in auditd configuration files	Generic	test	file_event	linux	Linux Auditd	Defense Impairment Disable or Modify Tools	-	high	Mikhail Larin, oscd.community	2019-10-25	2021-11-27	977ef627-4539-4875-adf4-ed8f780c4922
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
Splunk	The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	medium	Bhavin Patel, Splunk	2025-03-25	2026-05-13	8b4e3d62-f743-11ee-9f6e-acde48001123
	Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-07-10	—	59b70e4d-dd17-44a9-b740-acf07ae3eb6a
	Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety c (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-07-10	—	1c722651-254a-4b04-a9f4-99b62a2d0a1f
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects when a EFS Fileshare Mount is modified or deleted. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	medium	Austin Songer @austinsonger	2021-08-15	2022-10-09	6a7ba45c-63d8-473e-9736-2eaabff79964
	Identifies when an EKS cluster is created or deleted.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	low	Austin Songer	2021-08-16	2022-10-09	33d50d03-20ec-4b74-a74e-1e65a38af1c0
	Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	high	suktech24	2025-11-27	—	d2656e78-c069-4571-8220-9e0ab5913f19
	Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	high	faloker	2020-02-11	2022-10-09	6e61ee20-ce00-4f8d-8aee-bedd8216f7e3
	Detects evade to Macie detection.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Sittikorn S	2021-07-06	2023-03-24	91f6a16c-ef71-437a-99ac-0b070e3ad221
	Detects the modification of the findings on SecurityHub.	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	high	Sittikorn S	2021-06-28	—	a607e1fe-74bf-4440-a3ec-b059b9103157
Splunk	The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...)	Generic	stable	account_management	-	Microsoft 365	Defense Impairment Disable or Modify Tools	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-05-13	875de3d7-09bc-4916-8c0a-0929f4ced3d8
	Detects when a Container Registry is created or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	low	Austin Songer @austinsonger	2021-08-07	2022-08-23	93e0ef48-37c8-49ed-a02c-038aab23628e
	Identifies when a device or device configuration in azure is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Data Manipulation Stored Data Manipulation	-	medium	Austin Songer @austinsonger	2021-09-03	2022-10-09	46530378-f9db-4af9-a9e5-889c177d3881
	Detects when a Azure Kubernetes Cluster is created or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	low	Austin Songer @austinsonger	2021-08-07	2022-08-23	9541f321-7cba-4b43-80fc-fbd1fb922808
	Detects when Events are deleted in Azure Kubernetes. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Defense Impairment Disable or Modify Tools	-	medium	Austin Songer @austinsonger	2021-07-24	2022-08-23	225d8b09-e714-479c-a0e4-55e6f29adf35
	Identifies when a Azure Kubernetes network policy is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	08d6ac24-c927-4469-b3b7-2e422d6e3c43
	Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	25cb259b-bbdc-4b87-98b7-90d7c72f8743
	Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	7ee0b4aa-d8d4-4088-b661-20efdf41a04c
	Identifies when ClusterRoles/Roles are being modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	818fee0c-e0ec-4e45-824e-83e4817b0887
	Identifies when a service account is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Account Access Removal Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	12d027c3-b48c-4d9d-8bb6-a732200034b2
	focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cob (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	critical	ok @securonix invrep_de, oscd.community	2020-10-09	2022-12-25	8d31a8ce-46b5-4dd6-bdc3-680931f1db86
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects changes to the bitbucket audit log configuration.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	6aa12161-235a-4dfb-9c74-fe08df8d8da1
	Detects Bitbucket global secret scanning rule deletion activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05
	Detects Bitbucket global SSH access configuration changes.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools Lateral Movement Remote Services SSH	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	16ab6143-510a-44e2-a615-bdb80b8317fc
	Detects when a secret scanning allowlist rule is added for projects.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	low	Muhammad Faisal (@faisalusuf)	2024-02-25	—	42ccce6d-7bd3-4930-95cd-e4d83fa94a30
	Detects when a repository is exempted from secret scanning feature.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	high	Muhammad Faisal (@faisalusuf)	2024-02-25	—	b91e8d5e-0033-44fe-973f-b730316f23a1
	Detects when secret scanning rule is deleted for the project or repository.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	low	Muhammad Faisal (@faisalusuf)	2024-02-25	—	ff91e3f0-ad15-459f-9a85-1556390c138d
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects powershell execution with that make use of to the bxor (Bitwise XOR). (...)	Hunting	test	ps_classic_start	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	low	Teymur Kheirkhabarov, Harish Segar	2020-06-29	2024-12-11	812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
	Detects calls to cmdlets that are used to export certificates from the local certificate store. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Credential Access Unsecured Credentials Private Keys	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-18	—	9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-11-01	2025-10-07	87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-10-20	2023-12-14	61d0475c-173f-4844-86f7-f3eebae1c66b
	Detects execution of ChromeLoader malware via a registered scheduled task	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Persistence Software Extensions	-	high	@kostastsale	2022-01-10	—	0a74c5a9-1b71-4475-9af2-7829d320d5c2
Splunk	Adversaries may intentionally suppress or reduce the volume of core Cisco ASA syslog messages to evade detection or cover their tracks. (...)	Hunting	stable	firewall	-	Cisco Secure Firewall · Cisco	Defense Impairment Disable or Modify Tools	CVE-2025-20362 CVE-2025-20333	medium	Bhavin Patel, Micheal Haag, Splunk	2025-09-25	2026-05-13	4b4f8fdd-1f9e-45d8-9b0f-1f64c0b297a4

Title

Description

LazyWiper S9039

LazyWiper S9039

LazyWiper MITRE reference S9039

Standing S9039

Reach

Coverage

LazyWiper detections S9039