Kaspersky published research this week on Lotus Wiper, a previously unknown destructive malware used in targeted attacks against Venezuela's energy and utilities sector in late 2025 and early 2026. The malware was compiled in September 2025 and a sample was uploaded to a public malware repository from a machine in Venezuela in mid-December, weeks before significant geopolitical events in the region in early January. The attack carries no ransom demand, no extortion mechanism, and no payment path. The sole objective is permanent destruction. The attack chain begins with two batch scripts that coordinate across domain-joined machines before the wiper deploys. The first script checks for a remote trigger file on the organization's NETLOGON share, allowing the attacker to control when destruction begins across multiple systems simultaneously. The second script enumerates user accounts, resets passwords to random strings, disables accounts, logs off all active sessions, and disconnects network interfaces before the wiper runs. Lotus Wiper itself operates at a low level, interacting directly with physical disks. It deletes all Windows restore points, overwrites every physical sector with zeroes, clears the USN journal to eliminate forensic traces, and deletes all files across every mounted volume. Files that cannot be deleted immediately are scheduled for removal at the next reboot. The result is a system that cannot be restored through any standard recovery method. Kaspersky notes the malware targeted machines running pre-Windows 10 1803 versions, indicating the attackers had detailed knowledge of the environment and likely had persistent access for months before the destructive phase began. No attribution to a specific threat actor has been confirmed.

Enclave AI researcher Yanir Tsarimi disclosed a critical authentication flaw in Microsoft's Azure SRE Agent, a cloud AI tool that autonomously monitors Azure environments, diagnoses outages, and executes remediation actions on behalf of IT teams. The agent has access to logs, source code, deployment credentials, and integrations with incident management platforms. The flaw, tracked as CVE-2026-32173 with a CVSS score of 8.6, stemmed from a misconfiguration in how the agent's event hub authenticated connecting clients. The Entra ID app registration behind the hub was configured as multi-tenant, meaning any account from any Entra ID tenant could obtain a valid token that the hub would accept. Once connected, the hub broadcast all events to all clients with no identity filtering. An outside attacker needed only a free Azure account, the target agent's web address, and roughly 15 lines of code. The exposed stream included user prompts, agent responses, internal reasoning traces, every command executed with full arguments, and all command output. Tsarimi demonstrated reading live deployment credentials for web applications from another organization's agent during testing. The attack left no trace in the target organization's logs. Microsoft confirmed the flaw, rated it critical, and patched it on the server side. No customer action is required to receive the fix, but organizations using the Azure SRE Agent should audit what access and integrations the agent has been granted.