Skip to main content

SHARPKNOT Wiper

First observed in 2005, Shellbot is a remote access trojan primarily used as a backdoor and downloader for other malware.
Threat ID:
CC-2208
Category:
Threat Severity:
Medium
Threat Vector:
Published:
5 April 2018 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

First observed in 2005, Shellbot is a remote access trojan primarily used as a backdoor and downloader for other malware.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

  • Microsoft Windows - All versions

Threat details

At present it is unclear how SHARPKNOT is delivered, although it is likely that a number of other HIDDEN COBRA tools are used to install it during their own infection processes. When executed from the command line, SHARPKNOT will first attempt to overwrite the Master Boot Record of the affected device. Once this is done it will enumerate the available local, network and removable drives before overwriting these.

For further information

Remediation advice

To prevent and detect an infection, ensure that:

Remediation steps

Type Step
  • A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails.
  • All operating systems, antivirus and other security products are kept up to date.
  • All day to day computer activities such as email and internet are performed using non-administrative accounts.
  • Strong password policies are in place and password reuse is discouraged.
  • Network, proxy and firewall logs should be monitored for suspicious activity.
  • User accounts accessed from infected machines should be reset on a clean computer.

Last edited: 17 February 2020 12:54 pm