aol.pm

KillDisk

Software · ATTACK:enterprise:S0607

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0607",
  "title": "KillDisk",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0607",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--e221eb77-1502-4129-af1d-fe1ad55e7ec6",
  "external_id": "S0607",
  "domain": "enterprise",
  "created": "2021-01-20T18:05:07.059Z",
  "modified": "2023-10-06T14:09:52.833Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "KillDisk Ransomware",
      "url": "https://www.bleepingcomputer.com/news/security/killdisk-disk-wiping-malware-adds-ransomware-component/"
    },
    {
      "source_name": "ESEST Black Energy Jan 2016",
      "url": "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
    },
    {
      "source_name": "Trend Micro KillDisk 1",
      "url": "https://www.trendmicro.com/en_us/research/18/f/new-killdisk-variant-hits-latin-american-financial-organizations-again.html"
    },
    {
      "source_name": "Trend Micro KillDisk 2",
      "url": "https://www.trendmicro.com/en_us/research/18/a/new-killdisk-variant-hits-financial-organizations-in-latin-america.html"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1530b5b9-a559-42ac-a668-8133cb18e944

Trend Micro KillDisk 2

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c69d2f9-1152-415a-9294-808886999e04

Trend Micro KillDisk 1

ATTACK:enterprise:C0028 → uses → ATTACK:enterprise:S0607

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1dad5efc-395f-4b92-8f4f-3e987a4d5e57

Booz Allen Hamilton

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22b9eb17-686a-4cfe-b9a1-cffe22c7755f

Trend Micro KillDisk 1

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75640de7-9608-4c19-a0b3-6fb4816ec56a

Trend Micro KillDisk 1

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75c7794b-e8e1-4fcb-b59a-14eb710c47f7

Trend Micro KillDisk 2

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77d6442b-5730-4a3b-a3bb-f86054dd8402

ESEST Black Energy Jan 2016

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89567fdb-433a-4821-85bb-a4a9f55cfef5

Trend Micro KillDisk 1

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8efafb84-44c7-405d-96b6-55d12f397d01

Trend Micro KillDisk 2

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1529

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d6c5d09-94b9-4453-a26d-8b3ac79cfe7f

Trend Micro KillDisk 2

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1561.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b12cc736-ee7a-4a70-b4f0-2048e218310f

Trend Micro KillDisk 1

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6cfaa54-2ce3-40c8-af91-cd09e6e9c167

KillDisk Ransomware

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c86a1525-d555-4467-8d1c-1f8b0c277d1c

ESET Telebots Dec 2016

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:S0607

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb1037c1-4b83-4a79-ba12-00558bb6b42b

ESET Lazarus KillDisk April 2018

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb51ada4-7c8e-4f4b-a70c-af7f764ac878

ESET Telebots Dec 2016

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:S0607

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce64ed04-f0ff-4897-b636-3177c9c5d9bb

US District Court Indictment GRU Unit 74455 October 2020 · Secureworks IRON VIKING

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d84bda97-a8d5-4886-8172-c5a794b681af

Trend Micro KillDisk 2

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1485

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e45c0080-ee1c-4ef1-813f-d58b83de4a8b

ESEST Black Energy Jan 2016

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.