Procedure examples

AcidRain reboots the target system once the various wiping processes are complete.

AvosLocker’s Linux variant has terminated ESXi virtual machines.

Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.

DynoWiper has used the Microsoft Windows native `ExitWindowsEx()` function to log off the interactive user and shutdown the system.

ShrinkLocker can restart the victim system if it encounters an error during execution, and will forcibly shutdown the system following encryption to lock out victim users.

Apostle reboots the victim machine following wiping and related activity.

WhisperGate can shutdown a compromised host through execution of `ExitWindowsEx` with the `EXW_SHUTDOWN` flag.

AcidPour includes functionality to reboot the victim system following wiping actions, similar to AcidRain.

CHIMNEYSWEEP can reboot or shutdown the targeted system or logoff the current user.

DCSrv has a function to sleep for two hours before rebooting the system.

NotPetya will reboot the system one hour after infection.

LockerGoga has been observed shutting down infected systems.

MultiLayer Wiper reboots the infected system following wiping and related tasks to prevent system recovery.

DarkGate has used the `shutdown`command to shut down and/or restart the victim system.

Latrodectus has the ability to restart compromised hosts.

Shamoon will reboot the infected system once the wiping functionality has been completed.

Black Basta has used `ShellExecuteA` to shut down and restart the victim system.

XLoader can initiate a system reboot or shutdown.

HermeticWiper can initiate a system shutdown.

LookBack can shutdown and reboot the victim machine.

BFG Agonizer uses elevated privileges to call NtRaiseHardError to induce a "blue screen of death" on infected systems, causing a system crash. Once shut down, the system is no longer bootable.

Maze has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.

KillDisk attempts to reboot the machine by terminating specific processes.

Qilin can initiate a reboot of the backup server to hinder recovery.

Remcos can shutdown and restart remote devices.

CanisterWorm has forced the target system to reboot after file deletion.