Description
KillDisk is destructive malware that wipes disk data on infected systems, overwriting files and disk structures so that recovery becomes impossible without backups. Researchers first observed it in attacks on Ukrainian organizations, and later variants added ransomware behavior that demanded payment for data the malware had already destroyed. Because wiping is irreversible, defenders treat KillDisk detections as evidence of a severe intrusion and prioritize containment.
Stats
- First seen
- March 2022
- Last seen
- October 2026
Also known as
Killdisk
MITRE ATT&CK techniques
15 techniques across 5 tactics.
TA0005 Stealth
TA0040 Impact
Associated groups
Associated campaigns
Alert name variants
| Alert Name |
|---|
| Gen:Variant.KillDisk.7 |
| Gen:Variant.KillDisk.82 |
| Gen:Variant.Trojan.KillDisk.37 |
| Trojan.KillDisk.A |
| Trojan.KillDisk.AE |
| Trojan.KillDisk.B |
| Trojan.KillDisk.CTPJ |
| Trojan.Ransom.KillDisk.B |
| Win32.Ransomware.Killdisk |
| Win32.Ransomware.KillDisk |
