KillDisk

MITRE ATT&CK: S0607 View on attack.mitre.org

Aliases: Win32/KillDisk.NBI, Win32/KillDisk.NBH, Win32/KillDisk.NBD, Win32/KillDisk.NBC, Win32/KillDisk.NBB, KillDisk

First seen
2015-12-01 00:00:00
Malware type
wiper, ransomware
Family
Malware family
Operating systems
linux, windows
Profile updated
2026-07-07 12:44:36

Targeted industries: energy-and-utilities government-and-public-sector media-and-entertainment

Targeted regions: country_code:ua country_code:pl country_code:br

Context

KillDisk is a disk-wiping tool designed to overwrite files with random data to render the OS unbootable. It was first observed as a component of BlackEnergy malware during cyber attacks against Ukraine in 2015. KillDisk has since evolved into stand-alone malware used by a variety of threat actors against additional targets in Europe and Latin America; in 2016 a ransomware component was also incorporated into some KillDisk variants.

Detection coverage

  • 2 YARA rules
  • 206 Sigma rules

Malware & tools used

  • File and Directory Discovery (attack-pattern)
  • Native API (attack-pattern)
  • Local Storage Discovery (attack-pattern)
  • Shared Modules (attack-pattern)
  • Process Discovery (attack-pattern)
  • Clear Windows Event Logs (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Service Stop (attack-pattern)
  • System Shutdown/Reboot (attack-pattern)
  • Disk Structure Wipe (attack-pattern)
  • Data Encrypted for Impact (attack-pattern)
  • File Deletion (attack-pattern)
  • Masquerade Task or Service (attack-pattern)
  • Access Token Manipulation (attack-pattern)
  • Data Destruction (attack-pattern)
  • Loss of View (attack-pattern)
  • Indicator Removal on Host (attack-pattern)
  • Data Destruction (attack-pattern)
  • Service Stop (attack-pattern)

Used by threat actors

  • 2015 Ukraine Electric Power Attack (campaign)
  • Sandworm Team (threat-actor)
  • APT38 (threat-actor)

Detection rules

  • MALPEDIA_Win_Lazarus_Killdisk_Auto (yara-rule)
  • MALPEDIA_Win_Killdisk_Auto (yara-rule)

Reports & references

  • MITRE ATT&CK — G0034 (report)
  • ESET — Rise Telebots Analyzing Disruptive Killdisk Attacks (report)
  • ESET — Killdisk Now Targeting Linux Demands 250K Ransom Cant Decrypt (report)
  • secureworks.com — Iron Viking (report)
  • bleepingcomputer.com — Killdisk Disk Wiping Malware Adds Ransomware Component (report)
  • youtube.com — Watch (report)
  • CrowdStrike — The Anatomy Of Wiper Malware Part 1 (report)
  • blog.nviso.eu — Threat Update Ukraine Russia Tensions (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Killdisk (report)
  • ctfiot.com — 224570 (report)
  • ESET — Blackenergy Sshbeardoor Details 2015 Attacks Ukrainian News Media Electric Industry (report)
  • MITRE ATT&CK — S0607 (report)
  • Trend Micro — New Killdisk Variant Hits Financial Organizations In Latin America (report)
  • Trend Micro — New Killdisk Variant Hits Latin American Financial Organizations Again (report)

External references