Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 19:52:38 UTC
Home > List all groups > List all tools > List all groups using tool KillDisk
 Tool: KillDisk
Names
KillDisk
Win32/KillDisk.NBI
Win32/KillDisk.NBH
Win32/KillDisk.NBD
Win32/KillDisk.NBC
Win32/KillDisk.NBB
Category Malware
Type Wiper
Description
(Trend Micro) The malware has since metamorphosed into a threat used for digital
extortion, affecting Windows and Linux platforms. The note accompanying the
ransomware versions, like in the case of Petya, was a ruse: Because KillDisk also
overwrites and deletes files (and don’t store the encryption keys on disk or online),
recovering the scrambled files was out of the question. The new variant we found,
however, does not include a ransom note.
Information
MITRE ATT&CK Malpedia AlienVault OTX Last change to this tool card: 30 December 2022
Download this tool card in JSON format
All groups using tool KillDisk
Changed Name Country Observed
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b3b552bc-dd11-4722-9d0b-5f00e4707473
Page 1 of 2

APT groups
  Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
  TeleBots 2015-Oct 2020
2 groups listed (2 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b3b552bc-dd11-4722-9d0b-5f00e4707473
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b3b552bc-dd11-4722-9d0b-5f00e4707473
Page 2 of 2