When Malware Hides in Plain Sight

A recently discovered malware strain called Lotus Wiper has been used in a targeted destructive attack against the energy sector. Unlike ransomware, it doesn’t encrypt files or demand payment. It simply destroys data permanently and leaves systems unrecoverable.

What makes this particularly relevant for Domino administrators is how it operated. The malware disguised itself as legitimate HCL Domino application components, using file names designed to look like normal Domino processes.

The lesson here isn’t that Domino is inherently vulnerable. It’s that unmonitored, poorly maintained environments are softer targets and that knowing what is running in your environment matters more than most organisations realise.

What Lotus Wiper Actually Did

Lotus Wiper was used in a targeted attack against an organisation in the energy and utilities sector. Researchers identified it as a purely destructive operation with no financial motivation; its sole purpose was to cause irreversible damage.

The malware’s behaviour was methodical and deliberate:

• It disabled recovery mechanisms before beginning destruction
• It overwrote drives sector by sector, making recovery impossible
• It changed user account passwords and disabled logins
• It deleted Windows System Restore points
• It systematically removed files and filled remaining storage to prevent recovery

By the time it had finished, affected systems had no viable recovery path.

What made it effective was not technical sophistication alone. It was the fact that attackers had already gained access to victim systems before the wiper was deployed and had staged their malicious files to look like normal Domino processes.

Why This Matters for Domino Administrators

The malware used file names that mimic legitimate Domino executables – names that would look unremarkable to anyone familiar with a normal Domino installation.

This technique is known as masquerading, and it is effective precisely because it exploits trust. In an environment where Domino processes are expected to be running, a file with a familiar looking name is less likely to trigger immediate concern.

This points to something important: the attackers weren’t exploiting a vulnerability in Domino itself. They were exploiting the gap between what an organisation expects to be running and what is actually running.

In environments where the application landscape is well understood, properly documented and actively monitored, that gap is much smaller.

What This Tells Us About Environment Management

Lotus Wiper succeeded in part because the attackers had time. They gained access, prepared their tools, and waited, all without being detected.

That kind of dwell time is far more likely in environments that lack:

• Active monitoring of running processes and system activity
• Clear documentation of what should be present
• Regular security reviews
• Up to date systems with current vendor support

This is not a problem unique to Domino environments. It is a problem common to any business critical platform that operates quietly in the background without regular attention.

The organisations most exposed to this type of attack are those where nobody has a clear picture of what is running, what has changed, or what normal looks like.

Reducing Exposure in Domino Environments

For organisations running Domino, reducing exposure to this type of threat comes down to visibility and maintenance.

Practically, this means:

• Keeping Domino server versions current and under active vendor support
• Maintaining a clear inventory of servers, applications and running processes
• Monitoring system activity for unusual behaviour
• Reviewing authentication and access controls regularly
• Ensuring backups are current, tested and stored separately from production systems
• Understanding what normal looks like, so that abnormal is easier to spot

None of these are extraordinary measures. They are the foundation of a well maintained environment.

The difference between an environment that detects unusual activity early and one that doesn’t is usually not the sophistication of the tools, it’s whether anyone is paying attention.