KillDiskMalware
- win32/killdisk.nbb
- win32/killdisk.nbc
- win32/killdisk.nbd
- win32/killdisk.nbh
- win32/killdisk.nbi
KillDisk is a generic detection name used by ESET to refer to destructive malware with disk wiping capabilities, such as damaging boot sectors and overwriting then deleting (system) files, followed by a reboot to render the machine unusable.From MISP Galaxy
Last reported 1 month ago, by Sekoia.io1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1561Disk Wipe
“…APT38, now considered as splitted between CryptoCore and Jade Sleet, which was a financially-motivated threat cluster, which leveraged disk-wipe techniques (KillDisk) as an anti-forensics measure in 2017.”
- T1657Financial Theft
“Of note, Andariel is particular as it used custom ransomware (Maui and H0lyGh0st) for financial theft, as well as ransomware-as-a-service (RaaS) developed by an operator of the Russian cybercrime ecosystem.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Beyond Lazarus: How North Korea Organizes Its Cyber Operations“… as splitted between CryptoCore and Jade Sleet, which was a financially-motivated threat cluster, which leveraged disk-wipe techniques (KillDisk) as an anti-forensics measure in 2017.”
Indicators in its reports
named in the reports above- 23.237.102[.]130in 1 report
- 37.120.154[.]98in 1 report
- 38.75.137[.]97in 1 report
- 45.86.208[.]162in 1 report
- 50.7.159[.]34in 1 report
- 91.239.130[.]102in 1 report
- 103.214.44[.]138in 1 report
- 167.88.61[.]117in 1 report
- 185.135.76[.]89in 1 report
- 188.43.33[.]252in 1 report
- 211.21.6[.]181in 1 report
- 70.32.3[.]15in 1 report
- 66.118.255[.]35in 1 report
- hxxps://www.hrnk[.]org/documentations/the-reconnaissance-general-bureau-the-kim-regimes-precious-treasured-sword/in 1 report
- www.hrnk[.]orgin 1 report
- hxxps://ieeexplore.ieee[.]org/document/8756954/in 1 report
- hxxps://www.kinu.or[.]kr/eng/module/report/view.do?idx=125351&nav_code=eng1674806000in 1 report
- www.kinu.or[.]krin 1 report
- hxxps://www.csis[.]org/analysis/hidden-enablers-third-countries-north-koreas-cyber-playbookin 1 report
- hxxps://understandingwar[.]org/research/china-taiwan/north-koreas-constitutional-amendments-cement-the-regimes-strategic-posture/in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.