Post by @kimzetter@infosec.exchange

2026-04-25 12:08 UTC

The mystery around a cyberattack against Venezuela&#39;s state-run oil company last December deepens with the discovery this week of a &quot;highly destructive&quot; wiper that may have been used in the attack. Previous reports had indicated that the December attack was a ransomware incident. But the wipr found this week was compiled last September, and hard-coded into it is the domain for Petróleos de Venezuela (PDVSA) , the state-run oil company. The hard-coded domain means the attackers had designed their precision weapon to only destroy data on the oil company&#39;s systems, not on any other system outside the company&#39;s domain. My story is below. Please consider becoming a paid subscriber if you like my work. https://www.zetter-zeroday.com/hwiper-targeting-venezuelas-state-oil-company-discovered/

Replies (3)

@Gabs@mastodonapp.uk 2026-04-25 12:49

@kimzetter@infosec.exchange CIA says what?

Open ##2394272
@bzdev@fosstodon.org 2026-04-25 18:04

@loius@mastodon.social @kimzetter@infosec.exchange Re "which agency is investigating the crime": my guess is the NSA, which at least has the technical expertise to pull it off. There's an old joke that NSA stands for either "No Such Agency" or "Never Say Anything".

Open ##2394273
@agreeable_landfall@mastodon.social 2026-04-25 19:52

@kimzetter@infosec.exchange When the bow and arrow was the main battle weapon, there was the problem that arrows one side shot could be fired back by the other side. I think these digital weapons are the same; Stuxnet was fired back. The Equation Group weapons were fired back. Until someone works out a way to make these things one-way (like they did by making arrows incompatible with the bows of the enemy), any use will make the entire globe a worse place to live.

Open ##2394274