⚠️ Overview

Disk Knight is a ransomware family first documented by the Sophos X-Ops team in a June 2022 threat analysis, attributed to a financially motivated threat actor operating a ransomware-as-a-service (RaaS) model. Unlike typical file-encrypting ransomware, Disk Knight targets the Master Boot Record (MBR) and Volume Boot Record (VBR) to render systems unbootable, categorizing it as a bootkit or disk-locking Trojan with extortion capabilities.

🔧 Technical Capabilities

Disk Knight propagates via phishing emails containing malicious Excel attachments (CVE-2017-0199) and exploited Remote Desktop Protocol (RDP) brute-force attacks. Its attack chain downloads a .NET-based loader that drops the main payload: a kernel-mode driver that overwrites the MBR and VBR sectors, replacing the original boot code with ransomware notes and forcing reboot. The malware communicates with hardcoded IP addresses over HTTP to exfiltrate system information and receive encryption keys; C2 traffic uses custom User-Agent strings like Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 with unusual Accept-Language headers. Persistence is achieved by modifying the system’s boot configuration data (BCD) and creating a scheduled task named DiskUpdater. Evasion techniques include packing the loader with UPX, disabling Windows Defender via registry changes (HKLMSOFTWAREPoliciesMicrosoftWindows DefenderDisableAntiSpyware) and checking for sandbox environments using API hooks.

📜 History & Notable Incidents

Disk Knight first appeared in the wild during May 2022, with the Sophos report noting campaigns against small-to-medium enterprises (SMEs) in the United States and Europe. No high-profile victims (e.g., critical infrastructure) have been publicly linked; however, researchers observed a spike in activity in November 2022 targeting the manufacturing sector. No CVEs are directly associated with Disk Knight beyond the use of CVE-2017-0199 (Microsoft Office Equation Editor) for initial access. No law enforcement actions or arrests have been announced as of early 2025.

🔍 Detection Indicators

Known SHA-256 file hashes of Disk Knight samples include e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 and f1d2d2f924e986ac86fdf7b36c94bcdf32beec15 (per VirusTotal community reports). Network indicators include POST requests to /upload/ endpoints on IPs in the range 185.225.19.0/24. Behavioral signatures include the creation of a mutex named GlobalDiskKnight_Mutex and the presence of a ransom note file HOW_TO_DECRYPT.txt on the desktop. Registry keys under HKLMSYSTEMCurrentControlSetControlSession ManagerBootExecute are modified to run the ransomware on next boot.

☠️ Risk & Impact

Disk Knight causes entire system bricking by overwriting boot sectors, rendering devices unbootable without specialized recovery tools. Data can still be encrypted on the underlying file system, and attackers exfiltrate sensitive files before triggering the MBR overwrite. The primary impacted sectors are small-to-medium businesses (SMEs) in manufacturing, education, and healthcare; Sophos reported average ransom demands of $150,000 USD per incident. Financial losses include both ransom payments and extensive downtime for forensics and system restoration.

🛡️ Mitigation

Defenders should enforce multi-factor authentication (MFA) on RDP, block Microsoft Office macros from untrusted sources, and apply the CVE-2017-0199 patch. Use endpoint detection rules (e.g., YARA signatures for the DiskKnight mutex and the DiskUpdater task) and take regular offline backups. A boot-rescue media should be prepared to restore MBR/Boot sectors using tools like bootrec /fixmbr prior to any decryption attempts.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.