Loading malware…
KillDisk is a destructive malware family primarily used to erase data and render computers inoperable. Variants target Windows and Linux, and some incorporate ransomware functionality. Its destructive routines overwrite files, critical system data, and disk structures, including the master boot record, preventing normal startup and complicating recovery. Ransomware variants encrypt files using AES with RSA-protected encryption keys.
KillDisk is closely associated with Sandworm Team and has been deployed as a destructive component of BlackEnergy. During the December 2015 attacks against Ukrainian electricity distribution companies, it damaged Windows-based operator workstations and human-machine interfaces, hindering restoration of the control environment. The attackers operated electricity breakers separately; KillDisk's role was to destroy systems and obstruct recovery. KillDisk has also been deployed in Lazarus-linked operations and attacks against Latin American financial institutions.
Implementation varies across samples. Analyzed Windows variants use native APIs to access physical disks, overwrite boot sectors, and force shutdown. Some samples use VMProtect to impede reverse engineering. Certain disk-wiping variants have no evident network communication, command-and-control, or ransomware functionality, distinguishing them from the family's file-encrypting variants.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Kill Disk ... CVE-2014-0751 ... Christmas 2015 Attacks
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.
"The most recent case was APT38 ... which was a financially-motivated threat cluster, which leveraged disk-wipe techniques (KillDisk) as an anti-forensics measure in 2017."
they deployed various malicious tools, including disk-wiping malware from the KillDisk family.
DOJ’s 2020 GRU Unit 74455 indictment describes destructive malware operations against Ukraine’s power grid, Ministry of Finance, and State Treasury Service, including BlackEnergy, Industroyer, and KillDisk, as part of a wider destabilization campaign.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Sandworm Team has used the BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces.
destruction of serial-to-Ethernet devices through malicious firmware updates
Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
69 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware / Outils # FakePenny (ransomware) Maui (ransomware) H0lyGh0st (ransomware) KillDisk (other) Qilin (ransomware) Play (ransomware)
Disk-wiping malware/technique reportedly leveraged by APT38 as an anti-forensics measure.
Destructive malware associated with GRU Unit 74455 and used in operations that rendered systems unable to perform their assigned functions.
Destructive wiper malware used in Russian operations against Ukrainian government and power-sector entities.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.