Skip to content

Malware

KillDisk

KillDisk is a generic detection name used by ESET to refer to destructive malware with disk wiping capabilities, such as damaging boot sectors and overwriting then deleting (system) files, followed by

KillDisk is a Windows malware family operated by Sandworm and TeleBots.

Background

KillDisk is an umbrella detection label ESET applies to destructive malware that wipes disks, for instance by corrupting boot sectors and overwriting then erasing (system) files before forcing a reboot that leaves the machine inoperable. Because it is a generic detection, all KillDisk variants behave similarly but individual samples need not share significant code or be otherwise related. Detections of this kind typically span numerous "sub-families" set apart by their detection suffix (for example KillDisk.NBO, KillDisk.NCV, and KillDisk.NCX). When sub-family variants do exhibit strong code overlap, they are occasionally observed across distinct attacks, allowing researchers to draw links between those campaigns.


Source: Malpedia (Fraunhofer FKIE).