KillDisk
- ID
- S0607
- Type
- Malware
- Associated names
- Win32/KillDisk.NBI, Win32/KillDisk.NBH, Win32/KillDisk.NBD, Win32/KillDisk.NBC, Win32/KillDisk.NBB
- Platforms
- Linux, Windows
- Source
- attack.mitre.org
- MITRE last modified
- 6 Oct 2023
KillDisk is a disk-wiping tool designed to overwrite files with random data to render the OS unbootable. It was first observed as a component of BlackEnergy malware during cyber attacks against Ukraine in 2015. KillDisk has since evolved into stand-alone malware used by a variety of threat actors against additional targets in Europe and Latin America; in 2016 a ransomware component was also incorporated into some KillDisk variants.[1][2][3][4]
Techniques used (15)
- T1027 Obfuscated Files or Information
- T1036.004 Masquerade Task or Service
- T1057 Process Discovery
- T1070.004 File Deletion
- T1083 File and Directory Discovery
- T1106 Native API
- T1129 Shared Modules
- T1134 Access Token Manipulation
- T1485 Data Destruction
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1529 System Shutdown/Reboot
- T1561.002 Disk Structure Wipe
- T1680 Local Storage Discovery
- T1685.005 Clear Windows Event Logs