A gut feeling of old acquaintances, new tools, and a common battleground

This Securelist analysis explores code- and string-level similarities between the ExPetr/NotPetya wiper and BlackEnergy (KillDisk) destructive modules, comparing targeted file-extension lists, recursive file enumeration code, and identifying clustered generic strings (e.g., "ComSpec", "InitiateSystemShutdown") to build a YARA rule that reliably flags both families; the report includes multiple sample hashes and emphasizes the findings are low-confidence for definitive attribution while inviting further research.