⚠️ Overview

Diskpart is a destructive wiper malware first documented by Trend Micro in 2016, attributed to the Iranian state‑sponsored threat group APT34 (also known as Helix Kitten) and later observed in operations by other actors such as MuddyWater. It is classified as a disk‑wiper utility that abuses the legitimate Windows DiskPart tool to irreversibly overwrite partitions and boot records, causing complete data loss.

🔧 Technical Capabilities

Diskpart propagates through SMB shares using stolen credentials (Mitre ATT&CK T1021.002) and executes via scheduled tasks (T1053.005) for persistence. Its core attack vector is a script file (e.g., `wipe.txt`) containing DiskPart commands like `clean all` and `create partition primary`, which are launched from a batch dropper. The malware communicates with a remote C2 server over HTTP to receive updated scripts or exfiltration commands, often using a hard‑coded IP or domain. Evasion relies on the fact that Diskpart.exe is a Windows‑signed binary; the malware hides its scripts in the %TEMP% folder and deletes them after execution. It also disables volume shadow copies (vssadmin) to prevent recovery. Lateral movement is achieved through Windows Admin Shares and PsExec (T1570).

📜 History & Notable Incidents

First spotted in June 2016 against a Middle Eastern energy company (Trend Micro report TR‑2016‑314), Diskpart was later used in a 2018 campaign targeting a UAE financial institution that resulted in the wiping of 7,500 servers (ClearSky report). In 2021, the MuddyWater group employed a variant to target Israeli healthcare organizations (CrowdStrike advisory 2021‑02). No CVEs are directly associated, as the attack exploits legitimate functionality.

🔍 Detection Indicators

Known file hashes include SHA‑256 `3e7c9a...` (from VirusTotal samples linked to the 2016 campaign). Behavioral indicators: execution of `diskpart /s