Loading malware…
SHARPKNOT is a destructive Lazarus Group malware family used to impair Windows systems by disabling selected services and corrupting the Master Boot Record, rendering hosts unbootable. It is characterized as an MBR wiper and forms part of the broader Lazarus destructive toolkit associated with long-running DPRK cyber operations. Reported behavior includes disabling the Microsoft Windows System Event Notification and Alerter services prior to destructive actions, then overwriting and deleting the MBR on victim machines. SHARPKNOT has been referenced alongside other Lazarus malware used in disruptive and sabotage-oriented operations, reflecting the group’s longstanding possession of disk-wiping capabilities dating back to at least 2009. High-confidence reporting supports Windows as the affected platform and destructive impact as the defining function of the malware.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR). APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable. CaddyWiper has the ability to destroy information about a physical drive's partitions including the MBR, GPT, and partition entries.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Wiper malware referenced as part of Lazarus’ broader toolset; no further technical detail provided in this content.
Master boot record wiper malware.
Lazarus-associated malware that disables Windows services to weaken host monitoring and alerting.
A Lazarus Group malware that overwrites and deletes the MBR on victim machines.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.