Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 14:22:41 UTC
Home > List all groups > List all tools > List all groups using tool RawDisk
 Tool: RawDisk
Names RawDisk
Category Tools
Description
RawDisk is a legitimate commercial driver from the EldoS Corporation that is used for
interacting with files, disks, and partitions. The driver allows for direct modification of
data on a local computer's hard drive. In some cases, the tool can enact these raw disk
modifications from user-mode processes, circumventing Windows operating system
security features.
Information
MITRE ATT&CK AlienVault OTX Last change to this tool card: 30 December 2022
Download this tool card in JSON format
All groups using tool RawDisk
Changed Name Country Observed
APT groups
 Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
1 group listed (1 APT, 0 other, 0 unknown)
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=327e1f94-7307-4f57-a992-f7e7cc206f5e
Page 1 of 2

Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=327e1f94-7307-4f57-a992-f7e7cc206f5e
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=327e1f94-7307-4f57-a992-f7e7cc206f5e
Page 2 of 2

APT groups Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
1 group listed (1 APT, 0 other, 0 unknown) 
   Page 1 of 2