{
  "family": "diskwriter",
  "sample_count": 17,
  "category": "trojan",
  "description": "Trojan:Win32/Diskwriter is a highly critical heuristic classification for malware designed to bypass the Windows file system (NTFS/FAT) and interact directly with the raw sectors of a hard drive. This classification encompasses some of the most destructive threats in the cyber landscape, including destructive Disk Wipers (like NotPetya or Shamoon) and advanced Bootkits.<br><br><b>Understanding Diskwriter</b><br>To the victim, a Diskwriter infection results in a completely unbootable system, often displaying a 'Missing Operating System' error or a fake ransom note at the BIOS/UEFI level. For incident responders, a Diskwriter alert is a catastrophic event. It indicates that malware has obtained high-level privileges and is actively destroying data or subverting the fundamental boot sequence of the machine. The goal is either pure sabotage (wipers) or extreme, undetectable persistence (bootkits).<br><br><b>Execution and Destructive Mechanics</b><br>Diskwriters are typically deployed in the final stages of a targeted attack or via destructive worms. Upon execution, the malware must elevate privileges to `SYSTEM` or obtain raw disk access rights. Once obtained, it uses APIs like `CreateFile` (pointing to physical drives like `\\\\.\\PhysicalDrive0`) to bypass the OS file system protections (`T1561.002`). Wiper variants will intentionally overwrite the Master Boot Record (MBR), the GUID Partition Table (GPT), or the Master File Table (MFT) with garbage data, rendering the drive unreadable (`T1561.001`). Bootkit variants will overwrite the MBR/VBR with malicious code, ensuring the malware loads into memory before the Windows kernel even starts (`T1542.003`), providing ultimate stealth.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system availability and often permanent data destruction. EDR platforms must immediately alert on any non-system process attempting to open a handle to a raw physical drive (`\\\\.\\PhysicalDriveX`). Because the OS is usually rendered unbootable, forensic analysis must be conducted offline by mounting the drive in a write-blocked forensic workstation to determine if data recovery is possible or if the MFT was completely destroyed.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1561.002",
    "T1561.001",
    "T1490",
    "T1542.003",
    "T1485"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1561.001",
      "name": "Disk Wipe: Disk Content Wipe",
      "tactic": "Impact"
    },
    {
      "id": "T1561.002",
      "name": "Disk Wipe: Disk Structure Wipe (MBR/GPT)",
      "tactic": "Impact"
    },
    {
      "id": "T1542.003",
      "name": "Boot or Logon Autostart Execution: Bootkit",
      "tactic": "Persistence"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "If a Diskwriter alert is triggered while the machine is still running, PULL THE POWER PLUG IMMEDIATELY (Hard Shutdown) to halt the wiping process and preserve whatever data is left.",
    "Do NOT attempt to reboot the machine normally, as the boot sequence itself may be corrupted or weaponized.",
    "Remove the hard drive and image it using a hardware write-blocker for offline forensic analysis and potential data carving/recovery.",
    "Initiate the enterprise disaster recovery plan, assuming the data on the drive is permanently lost."
  ],
  "what_to_avoid": [
    "Do not perform a graceful shutdown if active disk wiping is detected; a hard power-off is the only way to interrupt the raw write commands.",
    "Avoid assuming a standard backup restoration will fix a bootkit; the drive must be completely wiped (zeroed) and repartitioned to eradicate the MBR infection."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}