Mystery Around Venezuelan Cyberattack Deepens, with New Discovery of “Highly Destructive” Wiper

The mystery around a cyberattack that struck Venezuela’s state-owned oil company in December is growing, following an announcement by researchers this week that they had discovered a “highly destructive” wiper program that appears to have been designed to target the oil company and may have been used in the December attack against it.

Months before that cyberattack, and before US forces invaded Venezuela to seize then-Venezuelan President Nicolás Maduro, someone compiled the destructive wiper files and hard-coded the domain of Venezuela’s state-owned oil company – Petróleos de Venezuela, or PDVSA – into a script used to trigger the wiping operations. The latter was aimed at erasing data and critical files from targeted systems, to render them inoperable. The hard-coded domain ensured that if the malware infected systems on any network outside of the PDVSA domain, it would not wipe their files.