Wipers & Destructive Malware

Threat Class: Sabotage & Data Destruction Implant Tracked Families: 1 Severity: CRITICAL MITRE ATT&CK Aligned

Threat Landscape & Operational Overview

Wipers are malicious programs created purely for sabotage, denial-of-service, and irreparable data destruction. Unlike ransomware, which provides cryptographic decryption keys in exchange for extortion payments, wipers deliberately destroy partition tables, corrupt Master File Tables (MFT), overwrite raw disk sectors with random byte garbage or zero-fills, and terminate critical infrastructure services. Wipers are frequently deployed by nation-state actors during geopolitical conflicts or used as scorched-earth diversions to cover the tracks of deep corporate espionage.

🛡️ Enterprise Incident Response & Hardening Guidance

Dealing with an active security incident or looking to harden enterprise defenses against this threat class? Read our dedicated operational engineering guide:

→ Open Master Guide: Wiper & Destructive Malware Protection

Primary MITRE ATT&CK Tactics & Techniques

Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:

ID	Technique	Tactic	Observed Operational Behavior
`T1561.002`	Disk Structure Wipe	Impact	Overwrites the MBR, GPT, and partition tables to render the system unbootable.
`T1561.001`	Disk Content Wipe	Impact	Recursively overwrites file contents and file headers with zero-bytes or random noise.
`T1485`	Data Destruction	Impact	Deletes databases, virtual disk images (.vmdk, .vhdx), and operational records.
`T1490`	Inhibit System Recovery	Impact	Deletes Volume Shadow Copies, bcdedit configurations, and recovery partitions.
`T1529`	System Shutdown/Reboot	Impact	Forces immediate hard system reboots to trigger unbootable disk state.

Actively Weaponized Exploits & Vulnerabilities (2 CVEs)

Adversaries deploying wipers & destructive malware frequently weaponize the following software vulnerabilities for initial ingress, privilege escalation, or lateral movement:

CVE-2017-0144 CVSS 9.8 CRITICAL

Microsoft Windows SMBv1 Remote Code Execution (EternalBlue / MS17-010)

Attributed Payloads: killdisk

View Exploitation Dossier →

CVE-2014-4114 CVSS 9.3 CRITICAL

Microsoft Windows OLE Package Packager Remote Code Execution (Sandworm)

Attributed Payloads: killdisk

View Exploitation Dossier →

→ Explore all 63 weaponized vulnerabilities in our master CVE Exploitation Matrix

SOC Incident Containment Checklist

Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:

Sever enterprise network connectivity immediately to prevent automated lateral wiper propagation.
Do not allow forced system reboots if wiper activity is detected; capture memory and uncorrupted file handles immediately.
Verify the physical isolation and integrity of immutable offline and offsite backups.
Engage national cyber security authorities and emergency incident response response teams.
Prepare fresh hardware and clean baseline images for complete infrastructure rebuilding.

⚠️ Critical Mistakes to Avoid:

Do not reboot an infected machine; rebooting frequently executes the irreversible disk-destroying payload.
Do not assume wiper messages are genuine ransomware; negotiating with wipers is completely futile.

Prominent Malware Families in this Category

Top documented threats ranked by historical prevalence and behavioral signatures:

killdisk

EMBER Samples: 1

Trojan:Win32/KillDisk is a catastrophic industrial wiper malware family developed and deployed by Russian military intelligence hackers b...

View Profile & Rules →

Complete Directory (1 Families)

Alphabetical index of all tracked malware families cataloged under wipers & destructive malware:

killdisk