T1485: Data Destruction — MITRE ATT&CK Technique

Description

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)

To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).

In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments.

Platforms

ContainersESXiIaaSLinuxmacOSWindows

Sub-Techniques (1)

T1485.001

Lifecycle-Triggered Deletion

Mitigations (3)

Data BackupM1053

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.(Citation: Ready.gov IT DRP) Ensure backups are stored off system and protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.

User Account ManagementM1018

In cloud environments, limit permissions to modify cloud bucket lifecycle policies (e.g., PutLifecycleConfiguration in AWS) to only those accounts that require it. In AWS environments, consider using Service Control policies to limit the use of the PutBucketLifecycle API call.

Multi-factor AuthenticationM1032

Implement multi-factor authentication (MFA) delete for cloud storage resources, such as AWS S3 buckets, to prevent unauthorized deletion of critical data and infrastructure. MFA delete requires additional authentication steps, making it significantly more difficult for adversaries to destroy data without proper credentials. This additional security layer helps protect against the impact of data de

Threat Groups (8)

ID	Group	Context
G0082	APT38	[APT38](https://attack.mitre.org/groups/G0082) has used a custom secure delete function to make deleted files unrecoverable.(Citation: FireEye APT38 O...
G0034	Sandworm Team	[Sandworm Team](https://attack.mitre.org/groups/G0034) has used [CaddyWiper](https://attack.mitre.org/software/S0693), [SDelete](https://attack.mitre....
G1053	Storm-0501	[Storm-0501](https://attack.mitre.org/groups/G1053) has destroyed data and backup files.(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025...
G0032	Lazarus Group	[Lazarus Group](https://attack.mitre.org/groups/G0032) has used a custom secure delete function to overwrite file contents with data from heap memory....
G1004	LAPSUS$	[LAPSUS$](https://attack.mitre.org/groups/G1004) has deleted the target's systems and resources both on-premises and in the cloud.(Citation: MSTIC DEV...
G1055	VOID MANTICORE	[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has conducted data wiping attacks on compromised systems.(Citation: Check Point VOID MANTICORE...
G1056	TeamPCP	[TeamPCP](https://attack.mitre.org/groups/G1056) has deployed privileged DaemonSets to delete files on Kubernetes clusters and has executed recursive ...
G1057	ShinyHunters	[ShinyHunters](https://attack.mitre.org/groups/G1057) has executed the `DeleteBucket` API call to delete buckets.(Citation: Unit42KelleyVaya_BlingLibr...

Associated Software (30)

ID	Name	Type	Context
S0139	PowerDuke	Malware	[PowerDuke](https://attack.mitre.org/software/S0139) has a command to write random data across a file and delete it.(Citation: Volexity PowerDuke Nove...
S1125	AcidRain	Malware	[AcidRain](https://attack.mitre.org/software/S1125) performs an in-depth wipe of the target filesystem and various attached storage devices through ei...
S0238	Proxysvc	Malware	[Proxysvc](https://attack.mitre.org/software/S0238) can overwrite files indicated by the attacker before deleting them.(Citation: McAfee GhostSecret)
S0365	Olympic Destroyer	Malware	[Olympic Destroyer](https://attack.mitre.org/software/S0365) overwrites files locally and on remote shares.(Citation: Talos Olympic Destroyer 2018)(Ci...
S9038	DynoWiper	Malware	[DynoWiper](https://attack.mitre.org/software/S9038) has overwritten files with 16-byte sequences of random data generated by the Mersenne Twister alg...
S1178	ShrinkLocker	Malware	[ShrinkLocker](https://attack.mitre.org/software/S1178) can initiate a destructive payload depending on the operating system check through resizing an...
S1133	Apostle	Malware	[Apostle](https://attack.mitre.org/software/S1133) initially masqueraded as ransomware but actual functionality is a data destruction tool, supported ...
S0689	WhisperGate	Malware	[WhisperGate](https://attack.mitre.org/software/S0689) can corrupt files by overwriting the first 1 MB with `0xcc` and appending random extensions.(Ci...
S1167	AcidPour	Malware	[AcidPour](https://attack.mitre.org/software/S1167) can perform an in-depth wipe of victim filesystems and attached storage devices through either dat...
S9030	SameCoin	Malware	[SameCoin](https://attack.mitre.org/software/S9030) can overwrite designated files on targeted systems with random bytes.(Citation: Check Point Wirte ...
S0659	Diavol	Malware	[Diavol](https://attack.mitre.org/software/S0659) can delete specified files from a targeted system.(Citation: Fortinet Diavol July 2021)
S0265	Kazuar	Malware	[Kazuar](https://attack.mitre.org/software/S0265) can overwrite files with random data before deleting them.(Citation: Unit 42 Kazuar May 2017)
S0089	BlackEnergy	Malware	[BlackEnergy](https://attack.mitre.org/software/S0089) 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting f...
S1135	MultiLayer Wiper	Malware	[MultiLayer Wiper](https://attack.mitre.org/software/S1135) deletes files on network drives, but corrupts and overwrites with random data files stored...
S0341	Xbash	Malware	[Xbash](https://attack.mitre.org/software/S0341) has destroyed Linux-based databases as part of its ransomware capabilities.(Citation: Unit42 Xbash Se...
S0140	Shamoon	Malware	[Shamoon](https://attack.mitre.org/software/S0140) attempts to overwrite operating system files and disk structures with image files.(Citation: Symant...
S0380	StoneDrill	Malware	[StoneDrill](https://attack.mitre.org/software/S0380) has a disk wiper module that targets files other than those in the Windows directory.(Citation: ...
S0697	HermeticWiper	Malware	[HermeticWiper](https://attack.mitre.org/software/S0697) can recursively wipe folders and files in `Windows`, `Program Files`, `Program Files(x86)`, `...
S0496	REvil	Malware	[REvil](https://attack.mitre.org/software/S0496) has the capability to destroy files and folders.(Citation: Kaspersky Sodin July 2019)(Citation: Secur...
S0693	CaddyWiper	Malware	[CaddyWiper](https://attack.mitre.org/software/S0693) can work alphabetically through drives on a compromised system to take ownership of and overwrit...

References

Frequently Asked Questions

What is T1485 (Data Destruction)?

T1485 is a MITRE ATT&CK technique named 'Data Destruction'. It belongs to the Impact tactic(s). Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render...

How can T1485 be detected?

Detection of T1485 (Data Destruction) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1485?

There are 3 documented mitigations for T1485. Key mitigations include: Data Backup, User Account Management, Multi-factor Authentication.

Which threat groups use T1485?

Known threat groups using T1485 include: APT38, Sandworm Team, Storm-0501, Lazarus Group, LAPSUS$, VOID MANTICORE, TeamPCP, ShinyHunters.