StoneDrill

MITRE ATT&CK: S0380 View on attack.mitre.org

Aliases: DROPSHOT, StoneDrill

Malware type
wiper
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:37:59

Targeted industries: government-and-public-sector energy-and-utilities

Targeted regions: country_code:sa country_code:eu

Context

StoneDrill is wiper malware discovered in destructive campaigns against both Middle Eastern and European targets in association with APT33.

Detection coverage

  • 1 YARA rules
  • 258 Sigma rules

Malware & tools used

  • Virtualization/Sandbox Evasion (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • File Deletion (attack-pattern)
  • System Time Discovery (attack-pattern)
  • Process Injection (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Disk Structure Wipe (attack-pattern)
  • Query Registry (attack-pattern)
  • Disk Content Wipe (attack-pattern)
  • Visual Basic (attack-pattern)
  • Screen Capture (attack-pattern)
  • Data Destruction (attack-pattern)

Used by threat actors

Detection rules

  • MALPEDIA_Win_Dropshot_Auto (yara-rule)

Reports & references

  • pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
  • Mandiant — Apt33 Insights Into Iranian Cyber Espionage (report)
  • Broadcom/Symantec — Elfin Apt33 Espionage (report)
  • Broadcom/Symantec — Shamoon Destructive Threat Re Emerges New Sting Its Tail (report)
  • pwc.co.uk — Cyber Threats 2019 Retrospect (report)
  • CrowdStrike — The Anatomy Of Wiper Malware Part 1 (report)
  • CrowdStrike — The Anatomy Of Wiper Malware Part 3 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Stonedrill (report)
  • media.kasperskycontenthub.com — Report Shamoon Stonedrill Final (report)
  • MITRE ATT&CK — S0380 (report)

External references