KillDisk is destructive malware used to overwrite or delete files and damage disk structures. Lazarus operators deployed two Win32/KillDisk.NBO variants to more than 100 machines at a compromised Central American online casino, possibly to conceal an espionage operation, extort the victim, or conduct sabotage. A separate variant targeting Latin American financial organizations lacked a ransom note, used hardcoded paths and a shutdown parameter, renamed itself while running, and overwrote the first and last sectors of volumes as well as Extended Boot Records. The reports also note distinct KillDisk subfamilies, so samples sharing the name are not necessarily related. MITRE ATT&CK S0607.