StoneDrill
MITRE ATT&CK: S0380 View on attack.mitre.org
Aliases: DROPSHOT, StoneDrill
- Malware type
- wiper
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 3 (3 malicious)
- Last IoC activity
- 2026-10-13 06:05:18
- Profile updated
- 2026-07-07 12:37:59
Targeted industries: government-and-public-sector energy-and-utilities
Targeted regions: country_code:sa country_code:eu
Context
StoneDrill is wiper malware discovered in destructive campaigns against both Middle Eastern and European targets in association with APT33.
Recent IoC activity
3 malicious indicators in Maltiverse are attributed to StoneDrill (S0380). The 3 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | f8a979b67bbe459468e08e57e672b4a6c0a6e5427760e61c7f92aa4dcf7a1a4c | 2026-10-13 | 1 |
| file sample | 28edc02d63b719bde3b0b26263f055084a7a7cccbcee2c100c47a55b62499a1e | 2026-10-10 | 1 |
| file sample | 1e06b4f666ca65aedd03a2e2e317f7dc3dbb974030b05765c43432199f46c002 | 2026-10-04 | 1 |
Detection coverage
- 1 YARA rules
- 258 Sigma rules
Malware & tools used
- Virtualization/Sandbox Evasion (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- File Deletion (attack-pattern)
- System Time Discovery (attack-pattern)
- Process Injection (attack-pattern)
- Security Software Discovery (attack-pattern)
- Windows Management Instrumentation (attack-pattern)
- Encrypted/Encoded File (attack-pattern)
- System Information Discovery (attack-pattern)
- Disk Structure Wipe (attack-pattern)
- Query Registry (attack-pattern)
- Disk Content Wipe (attack-pattern)
- Visual Basic (attack-pattern)
- Screen Capture (attack-pattern)
- Data Destruction (attack-pattern)
Used by threat actors
- APT33 (threat-actor)
Detection rules
- MALPEDIA_Win_Dropshot_Auto (yara-rule)
Reports & references
- Broadcom/Symantec — Shamoon Destructive Threat Re Emerges New Sting Its Tail (report)
- pwc.co.uk — Cyber Threats 2019 Retrospect (report)
- Mandiant — Apt33 Insights Into Iranian Cyber Espionage (report)
- Broadcom/Symantec — Elfin Apt33 Espionage (report)
- pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
- CrowdStrike — The Anatomy Of Wiper Malware Part 1 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Stonedrill (report)
- media.kasperskycontenthub.com — Report Shamoon Stonedrill Final (report)
- MITRE ATT&CK — S0380 (report)
- CrowdStrike — The Anatomy Of Wiper Malware Part 3 (report)