MITRE ATT&CKsoftware (malware)

S0607 KillDisk

Published 2021-01-20 Modified 2023-10-06 Official page ↗
Domain
enterprise, ics
Platforms
Linux, Windows
Aliases
Win32/KillDisk.NBI, Win32/KillDisk.NBH, Win32/KillDisk.NBD, Win32/KillDisk.NBC, Win32/KillDisk.NBB
Version
1.2
Created
2021-01-20

Description

KillDisk is a disk-wiping tool designed to overwrite files with random data to render the OS unbootable. It was first observed as a component of BlackEnergy malware during cyber attacks against Ukraine in 2015. KillDisk has since evolved into stand-alone malware used by a variety of threat actors against additional targets in Europe and Latin America; in 2016 a ransomware component was also incorporated into some KillDisk variants.

Related

Uses · MITRE ATT&CK (19)

  • T1685.005 Clear Windows Event Logs sub-technique
  • T1680 Local Storage Discovery technique
  • T0809 Data Destruction technique
  • T0829 Loss of View technique
  • T0872 Indicator Removal on Host technique
  • T0881 Service Stop technique
  • T1561.002 Disk Structure Wipe sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1070.004 File Deletion sub-technique
  • T1529 System Shutdown/Reboot technique
  • T1489 Service Stop technique
  • T1486 Data Encrypted for Impact technique
  • T1485 Data Destruction technique
  • T1134 Access Token Manipulation technique
  • T1027 Obfuscated Files or Information technique
  • T1057 Process Discovery technique
  • T1083 File and Directory Discovery technique
  • T1106 Native API technique
  • T1129 Shared Modules technique

Referenced by MITRE ATT&CK · uses (3)

  • C0028 2015 Ukraine Electric Power Attack campaign
  • G0082 APT38 group
  • G0034 Sandworm Team group

References