{
  "family": "killdisk",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nKillDisk is a highly destructive malware family—specifically, a wiper—designed with the sole intention of rendering infected systems completely unbootable and permanently destroying data. It gained international notoriety for its deployment in coordinated cyber-kinetic attacks against critical infrastructure, most notably during the December 2015 attack on the Ukrainian power grid attributed to the Russian state-sponsored group known as Sandworm (Unit 74455).\n\n<h3>Technical Architecture and Destructive Capabilities</h3>\nKillDisk is typically deployed during the final stages of a targeted attack, often after threat actors have successfully exfiltrated sensitive data and achieved widespread lateral movement across an Industrial Control System (ICS) or enterprise network.\n\nUpon execution, KillDisk operates with elevated privileges to systematically destroy the host:\n<ul>\n<li><strong>MBR/VBR Destruction:</strong> The malware directly targets the physical sectors of the hard drive, explicitly overwriting the Master Boot Record (MBR) and the Volume Boot Record (VBR) with randomized data. This instantly renders the operating system unbootable.</li>\n<li><strong>File Overwriting:</strong> It traverses the file system, targeting specific file extensions (databases, configuration files, documents) and overwriting their contents with null bytes or random characters before deleting them, thwarting basic data recovery efforts.</li>\n<li><strong>Event Log Wiping:</strong> To hinder forensic investigations and incident response, KillDisk systematically deletes Windows Event Logs and system backups prior to initiating its destructive routine.</li>\n</ul>\nSome later variants of KillDisk have incorporated a superficial ransomware component, demanding payment, but the underlying encryption routines are often flawed or intentionally designed to ensure data recovery is impossible regardless of payment.\n\n<h3>Threat Impact</h3>\nThe deployment of KillDisk is an act of cyber sabotage. Its impact is catastrophic, leading to total data loss, severe operational downtime, and potentially physical consequences when deployed against critical infrastructure and SCADA systems.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Offline Backups:</strong> The only reliable defense against a successful wiper attack is a robust, isolated backup strategy. Implement the 3-2-1 backup rule, ensuring that at least one backup copy is stored completely offline and immutable (air-gapped).</li>\n<li><strong>Least Privilege and Network Segmentation:</strong> Strictly enforce the principle of least privilege, particularly for accounts managing ICS and critical servers. Segment networks to prevent lateral movement from the corporate IT environment to the operational technology (OT) environment.</li>\n<li><strong>Behavioral EDR:</strong> Deploy advanced EDR solutions configured to block unauthorized attempts to access raw disk sectors or rapidly delete volume shadow copies.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Wiper.KillDisk",
    "Trojan.KillDisk",
    "Sandworm Wiper"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1485",
    "T1561.001",
    "T1561.002",
    "T1070.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:03:45Z",
  "type": "Wiper",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}