Loading malware…
KillDisk is a destructive Windows malware family used to erase files and corrupt disk structures in order to render systems inoperable and impede recovery. It is most closely associated with Russian GRU Unit 74455, widely tracked as Sandworm, and has been repeatedly linked to disruptive operations against Ukrainian government and critical infrastructure targets. KillDisk is also documented as a destructive component deployed alongside BlackEnergy during the 2015 Ukraine electric power grid attack, where it was used to wipe Windows systems and hinder restoration after operators had already manipulated power distribution environments. Reporting also links updated KillDisk variants to later attacks against Ukrainian financial targets.
Functionally, KillDisk is a wiper rather than a conventional espionage implant. Documented behavior includes erasing selected files and corrupting the master boot record so that infected hosts become unbootable or otherwise unusable. In the Ukraine power-sector intrusions, its role was assessed as destructive follow-on action intended to delay recovery, reduce operator visibility, and complicate incident response rather than directly causing the outage itself. KillDisk has also been described as a plugin or destructive component delivered through the BlackEnergy ecosystem, reflecting Sandworm’s use of modular tooling in operations that combined credential theft, remote access, hands-on-keyboard activity, and destructive cleanup.
Operationally, KillDisk is part of a broader Sandworm pattern of timed disruptive attacks against critical infrastructure and government entities. Public U.S. government attributions and criminal indictments connect KillDisk to campaigns targeting Ukraine’s electric power grid, Ministry of Finance, and State Treasury Service. The malware’s use in these incidents illustrates a doctrine of pairing intrusion access with destructive effects to degrade an adversary’s ability to restore services. High-confidence reporting supports Windows as the primary platform for KillDisk activity discussed here, especially in enterprise and SCADA-adjacent environments affected during Ukrainian grid operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The US Department of Justice attributed KillDisk, Industroyer, NotPetya, and Olympic Destroyer operations to GRU officers associated with the unit.
DOJ’s 2020 GRU Unit 74455 indictment describes destructive malware operations against Ukraine’s power grid, Ministry of Finance, and State Treasury Service, including BlackEnergy, Industroyer, and KillDisk, as part of a wider destabilization campaign.
The final payload is a RAT module, with TCP communications and its commands indexed by 32-bit integers, cf. KillDisk in Central America.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Astaroth uses the LoadLibraryExW() function to load additional modules. Attor's dispatcher can execute additional plugins by loading the respective DLLs. ... LightSpy's main executable and module .dylib binaries are loaded using ... dlopen() ... dlsym() ... RotaJakiro uses ... .so files ... using dlopen() and dlsym().
...uses the LoadLibraryExW() function to load additional modules... execute additional plugins by loading the respective DLLs... loaded and executed DLLs in memory during runtime... loads a dynamic library (.dylib file) using dlopen() and obtains a function pointer... using dlopen() and dlsym()... calls LoadLibrary then executes exports from a DLL.
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
APT41 used VMProtected binaries in multiple intrusions. BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect. KillDisk uses VMProtect to make reverse engineering the malware more difficult. Turian can use VMProtect for obfuscation.
"created using Nullsoft Scriptable Install System (NSIS)... purposely named it 'MBR Killer.'"
“APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security …” / “APT38 clears Window Event logs and Sysmon logs …” / “BlackCat can clear Windows event logs using wevtutil.exe …” / “NotPetya uses wevtutil to clear the Windows event logs …”
Examples include "Cryptoistic can scan a directory to identify files for deletion" and "KillDisk has used the FindNextFile command as part of its file deletion process."
...uses the LoadLibraryExW() function to load additional modules... execute additional plugins by loading the respective DLLs... loaded and executed DLLs in memory during runtime... loads a dynamic library (.dylib file) using dlopen() and obtains a function pointer... using dlopen() and dlsym()... calls LoadLibrary then executes exports from a DLL.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
Multiple entries describe enumerating local, logical, or physical drives and disk/volume information, e.g., 'can enumerate local drives,' 'GetLogicalDrives,' 'fsutil fsinfo drives,' 'list drives,' and 'discover logical drive information including the drive type, free space, and volume information.'
BlackEnergy is a modular backdoor that can be used for several purposes, like espionage and downloading of destructive components... BlackEnergy used its modular architecture that supports several plugins to download and keep running both a variant of Dropbear SSH backdoor and a new destructive plugin called KillDisk.
After gaining internal access, the attacker conducted reconnaissance and prepared destructive actions including firmware damage, system-file deletion, and custom wiper execution.
Ukrainian Government & Critical Infrastructure: December 2015 through December 2016 destructive malware attacks against Ukraine’s electric power grid, Ministry of Finance, and State Treasury Service, using malware known as BlackEnergy, Industroyer, and KillDisk
The attackers didn’t just open breakers. They deployed KillDisk malware to prevent system restoration.
"AcidPour includes functionality to reboot the victim system following wiping actions..."; "AcidRain reboots the target system once the various wiping processes are complete"; "Apostle reboots the victim machine following wiping"; "APT37 ... issue the command shutdown /r /t 1 to reboot a system after wiping its MBR"; "APT38 ... BOOTWRECK ... initiate a system reboot after wiping the victim's MBR"; "Black Basta ... used ShellExecuteA to shut down and restart"; "DarkGate ... used the shutdown command"; "HermeticWiper can initiate a system shutdown"; "NotPetya will reboot the system one hour after infection"; "Shamoon will reboot the infected system once the wiping functionality has been completed"; "WhisperGate can shutdown ... through ... ExitWindowsEx"
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
46 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Destructive malware associated with GRU Unit 74455 and used in operations that rendered systems unable to perform their assigned functions.
Destructive wiper malware used in Russian operations against Ukrainian government and power-sector entities.
Destructive wiper used alongside the Ukraine 2015 BlackEnergy intrusion.
Destructive wiper family previously used in Sandworm-linked campaigns.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.