{
  "family": "killwin",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nKillWin is a classification for an extremely destructive category of Trojans (often referred to as \"Wipers\" or \"MBR Killers\"). Unlike ransomware, which encrypts data for financial extortion, the sole objective of KillWin malware is complete and irrecoverable system sabotage. It is designed to permanently destroy the operating system, erase all user data, and render the workstation entirely unbootable.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKillWin malware is typically deployed in the final stages of a targeted attack (often by nation-state actors or disgruntled insiders) to destroy forensic evidence after data exfiltration, or as a tool of pure cyber warfare to paralyze an organization.\n\nUpon execution, KillWin bypasses all subtlety and immediately attacks the core of the OS:\n<ul>\n<li><strong>MBR/VBR Destruction:</strong> The most critical action is the overwriting of the Master Boot Record (MBR) or Volume Boot Record (VBR) on the physical hard drive. This instantly breaks the boot sequence, resulting in a \"Missing Operating System\" or \"Blue Screen of Death\" upon the next restart.</li>\n<li><strong>File System Sabotage:</strong> Before forcing a reboot, the malware may rapidly iterate through the `C:\\Windows\\System32` directory, systematically deleting or corrupting critical DLLs and registry hives.</li>\n<li><strong>Irrecoverable Data Wiping:</strong> Advanced variants may utilize low-level API calls to overwrite sectors of the hard drive with random data (zeros), completely preventing data recovery via standard forensic carving tools.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA KillWin execution is a catastrophic event for the endpoint. The machine is instantly rendered unusable, and all local data must be considered permanently destroyed. If deployed via Active Directory Group Policy (GPO) or a software deployment tool (like SCCM), it can \"brick\" an entire corporate network in minutes.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Power-Off:</strong> If an active wiping process is suspected (rapid disk activity, system instability), the machine should be powered off immediately (hard shutdown) to prevent further sector overwriting.</li>\n<li><strong>Forensic Imaging (Offline):</strong> Do not attempt to boot the machine. Remove the physical drive and create a forensic image offline. Recovery *might* be possible if only the MBR was corrupted, but not if the data sectors were overwritten.</li>\n<li><strong>Restore from Immutable Backups:</strong> The only viable remediation is a complete bare-metal wipe, recreation of the Master Boot Record, and restoration of the OS and user data from offline, immutable backups.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.KillWin",
    "Wiper.KillWin",
    "Trojan.MBRKiller"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1561.001",
    "T1561.002",
    "T1485"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T06:39:27Z",
  "type": "Trojan / Wiper",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}