Skip to content

Hide Navigation Hide TOC

KillDisk (b5532e91-d267-4819-a05d-8c5358995add)

KillDisk is a disk-wiping tool designed to overwrite files with random data to render the OS unbootable. It was first observed as a component of BlackEnergy malware during cyber attacks against Ukraine in 2015. KillDisk has since evolved into stand-alone malware used by a variety of threat actors against additional targets in Europe and Latin America; in 2016 a ransomware component was also incorporated into some KillDisk variants.[KillDisk Ransomware][ESEST Black Energy Jan 2016][Trend Micro KillDisk 1][Trend Micro KillDisk 2]

Cluster A Galaxy A Cluster B Galaxy B Level
APT38 (dfbce236-735c-436d-b433-933bd6eae17b) Tidal Groups KillDisk (b5532e91-d267-4819-a05d-8c5358995add) Tidal Software 1
KillDisk (b5532e91-d267-4819-a05d-8c5358995add) Tidal Software Sandworm Team (16a65ee9-cd60-4f04-ba34-f2f45fcfc666) Tidal Groups 1