KillDisk was originally a disk wiping malware used by cyber-espionage group Sandworm team, also known as TeleBots, to target and sabotage ICS/SCADA networks in Ukraine. BlackEnergy group targeted Ukrainian critical infrastructures such as banks, powers grids etc. in 2015. Its main payload was to wipe all data contained in the hard disk drives that led to huge losses for Ukraine. Shortly after that, there was a Linux variant of this malware got discovered by ESET. This time it got repurposed to encrypt files, essentially turning it into ransomware. In this video, I demonstrate the Linux variant of KillDisk which appears to be more dangerous than typical ransomware. Checkout Intezer: https://analyze.intezer.com/ Twitter: https://twitter.com/Slmi0xC ------------------------------------------------------------------------------------------------------------- Music - Hackers by Karl Casey - Voyager by Karl Casey ------------------------------------------------------------------------------------------------------------- 00:00-00:12 Intro 00:12-02:23 Introduction & Analyzing 02:23-05:31 After execution 05:31-06:03 GRUB Overwrite 06:03-06:23 Outro ------------------------------------------------------------------------------------------------------------- This video is for educational purposes only; viewers should not attempt to infect any computer with a virus unless they have prior consent, legal authority, and are doing so for testing/educational purposes; and the video contains the footage of testing a virus on a Virtual Machine (VM), which means no people or machines were negatively impacted or harmed in the making of the video. Also, users should not try to replicate this (virus testing) at home without adequate prior knowledge or supervision, and they should only do so with their own computers; finally, they should never break the law in any way with the use of viruses, and if they do, neither I nor YouTube is responsible.