Technique with 1 sub-technique.View on attack.mitre.org
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable. In some cases politically oriented image files have been used to overwrite data.
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares..
In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers. Similarly, they may delete virtual machines from on-prem virtualized environments.
Rules on DetectionCode tagged with T1485 or one of its sub-techniques.
| ID | Name | Examples |
|---|---|---|
| T1485.001 | Lifecycle-Triggered Deletion | 0 |
| Used by | Procedure example |
|---|---|
| GroupAPT38 | APT38 has used a custom secure delete function to make deleted files unrecoverable. |
| GroupLAPSUS$ | LAPSUS$ has deleted the target's systems and resources both on-premises and in the cloud. |
| GroupLazarus Group | Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory. |
| GroupSandworm Team | Sandworm Team has used CaddyWiper, SDelete, and the BlackEnergy KillDisk component to overwrite files on victim systems. Additionally, Sandworm Team has used the JUNKMAIL tool to overwrite files with null bytes. |
| GroupShinyHunters | ShinyHunters has executed the `DeleteBucket` API call to delete buckets. |
| GroupStorm-0501 | Storm-0501 has destroyed data and backup files. |
| GroupTeamPCP | TeamPCP has deployed privileged DaemonSets to delete files on Kubernetes clusters and has executed recursive file deletions on non-containerized hosts. |
| GroupVOID MANTICORE | VOID MANTICORE has conducted data wiping attacks on compromised systems. VOID MANTICORE has also manually deleted files from compromised hosts, to include selecting all files and then deleting them. |
| Used by | Procedure example |
|---|---|
| MalwareAcidPour | AcidPour can perform an in-depth wipe of victim filesystems and attached storage devices through either data overwrite or calling various IOCTLS to erase them, similar to AcidRain. |
| MalwareAcidRain | AcidRain performs an in-depth wipe of the target filesystem and various attached storage devices through either a data overwrite or calling various IOCTLS to erase it. |
| MalwareApostle | Apostle initially masqueraded as ransomware but actual functionality is a data destruction tool, supported by an internal name linked to an early version, |
| MalwareBlackEnergy | BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents. |
| MalwareCaddyWiper | CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files. |
| MalwareCanisterWorm | CanisterWorm has targeted wiper components that can delete entire clusters and execute recursive file deletions on non-containerized hosts. |
| MalwareDEADWOOD | DEADWOOD overwrites files on victim systems with random data to effectively destroy them. |
| MalwareDiavol | Diavol can delete specified files from a targeted system. |
| Used by | Procedure example |
|---|---|
| Campaign2022 Ukraine Electric Power Attack | During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed CaddyWiper on the victim’s IT environment systems to wipe files related to the OT capabilities, along with mapped drives, and physical drive partitions. |
| Campaign2025 Poland Wiper Attacks | During the 2025 Poland Wiper Attacks, the adversaries utilized wiper malware to overwrite files using a 16-byte buffer that fully overwrites files 16 bytes or smaller or partially overwrites files greater than 16 bytes to speed up the process. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
