Quick answer: Killware is an informal term for cyberattacks associated with physical harm or danger to life. Usage varies: some writers reserve it for deliberate attempts to injure people, while others include dangerous consequences of service disruption. It is not a specific malware family or a reliable diagnosis. When physical systems are affected, qualified operators must coordinate safety and cyber response.
What does killware mean?
The term describes consequences or intent rather than a particular code structure. An attack might use stolen credentials, destructive software, ransomware, or unauthorized configuration changes. Calling it killware does not tell responders which vulnerability was used, whether malware is present, or whether anyone was actually harmed.
Reports also disagree about whether intent to cause injury is necessary. A careful account separates the attacker's demonstrated objective, the technical effect, the potential safety impact, and confirmed injury. A hospital outage or industrial intrusion should not automatically be described as a proven attempt to kill.
How a digital incident can create physical risk
- Loss of availability: staff lose access to systems needed to deliver an essential service.
- Loss of trustworthy information: altered readings, records, or alarms interfere with decisions.
- Unauthorized control: changed settings affect how equipment behaves.
- Dependency failure: unavailable communications, identity services, or suppliers prevent safe operation.
The physical outcome depends on engineering safeguards, trained personnel, continuity plans, and the process itself. An attacker gaining access does not mean every safety mechanism has failed. Conversely, an incident confined to office IT can still disrupt an essential service through dependencies.
Examples without assuming attribution
Consider a hypothetical facility where operators lose remote visibility of a process. The immediate question is whether local indications and approved procedures can maintain safe conditions. Restoring a server is only one part of the problem. Staff also need confidence that displayed values, equipment settings, and alarms reflect the real process.
In another illustrative scenario, a healthcare organization loses scheduling and communication systems. Continuity procedures may be needed even when clinical equipment is unaffected. Neither scenario by itself establishes a motive or a confirmed physical injury.
What to do during a suspected incident
Use established emergency arrangements and involve the responsible operators, engineers, and incident responders. If there is immediate danger, follow the site's emergency procedure. Give responders the affected service, time, observed behavior, and recent changes. Do not experiment with controls to find out what an attacker can do.
Disconnecting, scanning, restarting, or restoring equipment can itself interrupt a physical process. Those actions require an approved operational decision. Preserve available logs and access history where doing so does not interfere with safety. Recovery must include checks by the people responsible for the service, not just an IT malware scan.
How organizations reduce exposure
NIST's operational technology guidance emphasizes performance, reliability, and safety alongside security. Apply that perspective when planning maintenance, controlling remote access, separating systems, and evaluating monitoring tools. Security changes should be tested for the environment in which they will operate.
A practical preparedness exercise can start with a single essential service. List its supporting systems, identify who may authorize changes, verify an offline contact list, and walk through loss of the main administration platform. Record where staff would obtain trusted procedures and configuration records. Assign each discovered gap to an owner and repeat the exercise after important changes.
Killware vs. ransomware and cyberterrorism
Ransomware describes an extortion mechanism, often involving encryption or threatened disclosure. Cyberterrorism concerns terrorist objectives under differing definitions. Killware emphasizes physical danger. These descriptions can overlap, but none should substitute for evidence about the actual incident. For an individual reader, the most useful action is to report abnormal behavior to the responsible operator rather than attempt ordinary consumer cleanup on specialized equipment.
Reference: NIST SP 800-82: Guide to Operational Technology Security. Related: malware and cyberterrorism.