{
  "family": "diskwriter",
  "sample_count": 17,
  "category": "trojan",
  "description": "Diskwriter (classified across cybersecurity databases under designations including Trojan:Win32/Diskwriter, Wiper:Win32/Diskwriter, and Win32/Diskwriter) is an aggressive and destructive disk-wiping trojan designed to cause permanent data destruction on infected Windows computers. Distributed via weaponized spear-phishing campaigns and Trojanized utilities, Diskwriter requests elevated administrative privileges to acquire direct low-level device handles via CreateFileW targeting raw physical disks ('\\\\.\\PhysicalDrive0') and logical volume sectors. The malware writes randomized bytes or zeros across the Master Boot Record (MBR), GUID Partition Table (GPT), and NTFS Master File Table (MFT) structures. Once the low-level disk structures are destroyed, Diskwriter triggers an immediate hard system reboot or fatal blue screen (BSOD) via NtRaiseHardError, rendering the machine completely unbootable and causing irrecoverable data loss.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Diskwriter",
    "Wiper:Win32/Diskwriter",
    "Win32/Diskwriter",
    "Diskwriter Wiper",
    "Diskwriter MBR Destroyer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Diskwriter?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Diskwriter is a destructive disk-wiping trojan that permanently destroys low-level MBR and partition structures to render endpoints unbootable."
      }
    },
    {
      "@type": "Question",
      "name": "How does Diskwriter destroy hard drive data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It acquires direct raw handles to \\\\.\\PhysicalDrive0 via CreateFileW and overwrites the MBR, GPT, and Master File Table with garbage bytes."
      }
    },
    {
      "@type": "Question",
      "name": "Can data wiped by Diskwriter be recovered?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Data overwritten on the physical drive sectors cannot be restored by software tools and must be recovered from external offline backups."
      }
    },
    {
      "@type": "Question",
      "name": "How is Diskwriter delivered to victim environments?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through targeted spear-phishing attacks, malicious utility downloads, and secondary destructive stagers."
      }
    },
    {
      "@type": "Question",
      "name": "What defensive measures prevent Diskwriter attacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Restrict administrative privileges, enable UEFI Secure Boot, deploy EDR blocking raw disk writes, and maintain immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1561.001",
    "T1561.002",
    "T1529",
    "T1082",
    "T1106"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Targeted Spear-phishing Emails",
    "Trojanized Administrative Utilities",
    "Secondary Cyber Sabotage Stagers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "Raw Physical Disk Access (\\\\.\\PhysicalDrive0)",
    "Master Boot Record (MBR) & GPT Overwrite",
    "NTFS Master File Table (MFT) Corruption",
    "Forced System Crash / BSOD (NtRaiseHardError)",
    "Permanent Irrecoverable Data Destruction"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Kernel Driver (.sys)"
    ],
    "network_signatures": [
      "Outbound HTTP/HTTPS traffic reporting sabotage execution confirmation to remote C2"
    ],
    "evasion_techniques": [
      "Direct raw disk handle acquisition to bypass user-mode file system security filters",
      "Executing immediate BSOD to prevent defensive incident response intervention"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b",
      "6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c"
    ],
    "registry_keys": [
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\DiskWriterSvc"
    ],
    "file_paths": [
      "%AppData%\\DiskWriter\\diskwriter.exe",
      "%SystemRoot%\\System32\\drivers\\diskwriter.sys"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint security policies that block low-level raw disk write operations (\\\\.\\PhysicalDrive0) from user-mode processes",
    "Enable UEFI Secure Boot and BitLocker device encryption to protect boot sector integrity",
    "Maintain immutable, air-gapped backups to ensure business recovery after destructive wiper incidents"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Diskwriter",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Diskwriter"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Wiper.Win32.Diskwriter",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Diskwriter.A",
      "Wiper:Win32/Diskwriter.B"
    ]
  },
  "attack_stage": [
    "execution",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe",
    "raw_disk"
  ],
  "is_emerging": false,
  "motivation": "Cyber Sabotage & Permanent Data Destruction",
  "sample_hashes": []
}