Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 19:36:03 UTC
Home > List all groups > List all tools > List all groups using tool HDRoot
 Tool: HDRoot
Names
HDRoot
HDD Rootkit
Category Malware
Type Backdoor, Rootkit
Description
(Kaspersky) The program parameters are quite self-explanatory – this tool installs a
bootkit that infects the operating system during the boot stage with an arbitrary backdoor
specified as a parameter. The backdoor has to be a Win32 executable or dynamic link
library.
This utility is called “HDD Rootkit”; hence the base of our verdict names HDRoot. On 22
August 2006 the version number was 1.2.
Information
Malpedia AlienVault OTX Last change to this tool card: 24 April 2021
Download this tool card in JSON format
All groups using tool HDRoot
Changed Name Country Observed
APT groups
 APT 41 2012-Jul 2025
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e4011e0b-4d30-47ab-999a-2859bd0302ef
Page 1 of 2

1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e4011e0b-4d30-47ab-999a-2859bd0302ef
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e4011e0b-4d30-47ab-999a-2859bd0302ef
Page 2 of 2