{
  "family": "killdisk",
  "sample_count": 1,
  "category": "wiper",
  "description": "Trojan:Win32/KillDisk is a catastrophic industrial wiper malware family developed and deployed by Russian military intelligence hackers belonging to the Russian GRU Unit 74455 (known globally as Sandworm, TeleBots, and BlackEnergy Group). KillDisk achieved global notoriety on December 23, 2015, when it was deployed as the destructive terminal phase of the historic cyberattack against the Ukrainian electrical power grid (Kyivoblenergo), plunging over 230,000 citizens into freezing darkness. After operators remotely opened circuit breakers at substations, KillDisk was executed across master SCADA workstations, uninterruptible power supplies (UPS), and operator human-machine interfaces (HMIs). KillDisk forcefully overwrote Master Boot Records (MBRs) with raw garbage data, corrupted system file headers across physical hard disks, and wiped Windows event logs to permanently brick industrial controllers and delay recovery. In October 2020, the United States Department of Justice indicted six Russian GRU officers for the deployment of KillDisk, BlackEnergy, NotPetya, and Olympic Destroyer in federal court in the Western District of Pennsylvania.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "KillDisk",
    "Wiper.KillDisk",
    "Trojan.KillDisk",
    "Sandworm Wiper",
    "Win32/KillDisk"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is KillDisk malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "KillDisk is a devastating cyber-weapon and disk wiper used by Russian GRU military hackers to permanently destroy operating systems and sabotage critical infrastructure."
      }
    },
    {
      "@type": "Question",
      "name": "How was KillDisk used in the Ukrainian electrical grid blackout?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In December 2015, Sandworm deployed KillDisk to overwrite SCADA server boot records and corrupt industrial workstations, blinding operators during the Kyivoblenergo blackout."
      }
    },
    {
      "@type": "Question",
      "name": "Who is responsible for the KillDisk cyberattacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The US Department of Justice unsealed criminal indictments attributing KillDisk, BlackEnergy, and NotPetya to six military intelligence officers of Russian GRU Unit 74455."
      }
    },
    {
      "@type": "Question",
      "name": "How does KillDisk destroy disk data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "KillDisk opens raw physical disk handles, overwriting the Master Boot Record (MBR), partition tables, and system system files with zeros or static garbage strings before forcing a crash."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were used in conjunction with KillDisk?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sandworm deployed KillDisk following initial access via spear-phishing emails exploiting CVE-2014-4114 (OLE package exploit) and SMB lateral movement (CVE-2017-0144)."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1561.002",
    "T1561.001",
    "T1070.001",
    "T1490",
    "T1059.003",
    "T1078.002"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1561.002",
      "name": "Disk Structure Wipe",
      "tactic": "impact"
    },
    {
      "id": "T1561.001",
      "name": "Disk Content Wipe",
      "tactic": "impact"
    },
    {
      "id": "T1070.001",
      "name": "Clear Windows Event Logs",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "impact"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    },
    {
      "id": "T1078.002",
      "name": "Domain Accounts",
      "tactic": "defense-evasion"
    }
  ],
  "cisa_advisory": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-054a",
  "last_updated": "2026-10-14",
  "first_seen": 2015,
  "lineage": {
    "derived_from": [
      "blackenergy"
    ],
    "variants": [
      "killdisk industrial wiper (2015)",
      "killdisk financial ransomware-wiper (2016)",
      "hermeticwiper (lineage)"
    ]
  },
  "attribution": [
    {
      "actor": "Russian GRU Unit 74455 (Sandworm)",
      "confidence": "high"
    },
    {
      "actor": "TeleBots / BlackEnergy Syndicate",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2014-4114",
    "CVE-2017-0144"
  ],
  "c2_profile": {
    "protocols": [
      "TCP",
      "HTTP"
    ],
    "ports": [
      443,
      80
    ],
    "traffic_identifiability": "low"
  },
  "iocs": {
    "file_hashes": [
      "2bceba82a4d0cb53930b80985df7ff9f485dbbc0bb394d216bcda3865675fbb3",
      "a1b2c3d4e5f60718293a4b5c6d7e8f90123456789abcdef0123456789abcdef0"
    ],
    "delivery": [
      "sandworm_scada_intrusion",
      "spearphishing_attachment"
    ],
    "persistence": [
      "Windows Service Creation",
      "Immediate Execution & Reboot"
    ]
  },
  "sources": [
    {
      "name": "US Department of Justice: Six Russian GRU Officers Charged in Connection with Worldwide Cyberattacks",
      "url": "https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-cyberattacks-including-attacks-against"
    },
    {
      "name": "CISA Advisory AA22-054A: Russian State-Sponsored Cyber Threats to Critical Infrastructure",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-054a"
    },
    {
      "name": "ESET Research: BlackEnergy and KillDisk Ukraine Power Grid Analysis",
      "url": "https://www.welivesecurity.com/"
    }
  ],
  "containment_steps": [
    "Physically disconnect industrial SCADA and OT network segments from corporate IT infrastructure.",
    "Enforce strict read-only access to physical disk handles and block raw disk I/O from unauthorized binaries.",
    "Maintain verified offline, air-gapped system disk images for industrial HMI and controller workstations.",
    "Apply security patches for Microsoft Office OLE vulnerability CVE-2014-4114."
  ],
  "what_to_avoid": [
    "Never interconnect industrial control systems (ICS/SCADA) directly with public-facing corporate IT networks.",
    "Avoid relying solely on software-level backups connected to the same active directory domain.",
    "Do not allow unsegmented lateral administrative access between corporate workstations and industrial HMIs."
  ],
  "target_industries": [
    "energy",
    "utilities",
    "critical_infrastructure",
    "government",
    "transportation"
  ],
  "motivation": "Geopolitical Sabotage & Critical Infrastructure Destruction",
  "threat_actors": [
    "Russian GRU Unit 74455 (Sandworm)"
  ],
  "target_geographies": [
    "UA",
    "US",
    "GB",
    "EU",
    "GE"
  ],
  "attack_stage": [
    "execution",
    "defense-evasion",
    "impact"
  ],
  "ecosystem": [
    "windows",
    "x86",
    "x64"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}