Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1491.001: Internal Defacement

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.[1][2] Disturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.[3]

EnterpriseT1491.001Sub-techniqueObject v1.2 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Internal Defacement is an impact behavior where an intruder changes content seen by employees or internal users, such as internal websites, server login messages, or desktop wallpaper. For leaders, this matters because it is usually a visible signal that system integrity has been lost and may create confusion, intimidation, reputational pressure, or operational disruption inside the organization.

Executive priority

Treat internal defacement as more than a cosmetic incident. Because ATT&CK notes it often occurs after other intrusion goals have been accomplished, leadership should ask whether the visible message is a distraction from broader compromise, ransomware, wiper activity, or data-impact operations. Priority decisions should focus on incident containment, integrity validation, employee communications, restoration readiness, and evidence that backups and critical internal platforms can be recovered safely.

Technical view

SOC and IR teams should validate monitoring across Windows, Linux, macOS, and ESXi environments for unauthorized changes to internal web content, login banners/messages, and endpoint visual configuration such as wallpaper. ATT&CK provides no official detection text, but the related detection strategy DET0082 points to defacement through UI or messaging modifications. Investigations should correlate defacement artifacts with preceding authentication, administrative access, file modification, configuration change, and remote management activity. Relationship context links this technique to ransomware and wiper software families as well as named groups, so analysts should avoid treating it as isolated until integrity and lateral movement checks are complete.

Likely telemetry

  • File integrity and change records for internal website content and web roots
  • Web server access and administrative logs for internal sites
  • Endpoint logs showing wallpaper, shell, desktop, or user-interface configuration changes
  • System configuration and audit logs for server login banners or messages
  • Authentication and privilege-use logs around systems where defacement appeared

Detection direction

  • Baseline approved internal website content, login messages, and endpoint visual settings, then alert on unauthorized modification.
  • Tune detections to distinguish legitimate IT communications, branding updates, maintenance banners, and helpdesk-driven wallpaper changes from unexpected or broad changes.
  • Correlate defacement with recent administrative logons, privilege escalation, remote execution, file writes, and configuration changes rather than relying only on the visible artifact.
  • Prioritize alerts where defacement appears across multiple systems, critical servers, or virtualization platforms, as this may indicate broader access.
  • Use DET0082 as the relationship-backed detection strategy reference, but validate locally because the ATT&CK object does not provide official detection logic.

Mitigation priorities

  • Ensure Data Backup mitigation M1053 is operational for end-user systems and critical servers, including hardened, isolated backups protected from compromise during active incidents.
  • Maintain recovery procedures for internal web content, server configurations, and endpoint settings so defacement can be reversed without destroying forensic evidence.
  • Restrict and audit administrative paths capable of modifying internal websites, login messages, desktop settings, and ESXi/Linux/macOS/Windows system configurations.
  • Prepare incident communications playbooks for user-facing intimidation or misleading messages so employees receive trusted guidance quickly.
  • After containment, validate system integrity and investigate preceding intrusion activity before declaring the event resolved.
Analyst notes and limits

The most important decision point is whether the defacement is the final visible impact or a signal of deeper compromise. Relationship context includes Lazarus Group, Gamaredon Group, BlackByte, Remcos, Diavol, Meteor, BlackCat, Black Basta, INC Ransomware, ROADSWEEP, ShrinkLocker, RansomHub, Qilin, and SameCoin, but these are ATT&CK associations and should not be treated as attribution without local evidence.

Official ATT&CK detection guidance is not provided for this object. The recommendations above are derived from the supplied description, platforms, mitigation relationship to Data Backup, parent Defacement relationship, and DET0082 detection-strategy relationship. Local architecture, logging coverage, business-approved UI changes, and incident evidence are required to determine actual exposure or detection coverage.

Official MITRE ATT&CK definition

Internal Defacement

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.[1][2] Disturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.[3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1491 Defacement This object subtechnique of Defacement.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0047: Gamaredon Group

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]

Group Enterprise

G1043: BlackByte

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.[1][2][3][4][5]

Group Enterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Tool Enterprise

S0332: Remcos

Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. Remcos has been observed being used in malware campaigns.[1][2]

Windows
Malware Enterprise

S1178: ShrinkLocker

ShrinkLocker is a VBS-based malicious script that leverages the legitimate Bitlocker application to encrypt files on victim systems for ransom. ShrinkLocker functions by using Bitlocker to encrypt files, then renames impacted drives to the adversary’s contact email address to facilitate communication for the ransom payment.[1][2]

Windows
Malware Enterprise

S1070: Black Basta

Black Basta is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers. Black Basta operations have included the double extortion technique where in addition to demanding ransom for decrypting the files of targeted organizations the cyber actors also threaten to post sensitive information to a leak site if the ransom is not paid. Black Basta affiliates have targeted multiple high-value organizations, with the largest number of victims based in the U.S. Based on similarities in TTPs, leak sites, payment sites, and negotiation tactics, security researchers assess the Black Basta RaaS operators could include current or former members of the Conti group.[1][2][3][4][5][6]

WindowsESXi
Malware Enterprise

S0659: Diavol

Diavol is a ransomware variant first observed in June 2021 that is capable of prioritizing file types to encrypt based on a pre-configured list of extensions defined by the attacker. The Diavol Ransomware-as-a Service (RaaS) program is managed by Wizard Spider and it has been observed being deployed by Bazar.[1][2][3][4]

Windows
Malware Enterprise

S9030: SameCoin

SameCoin is a multi-platform wiper with Windows and Android versions that has been used by WIRTE to target entities in the Middle East including in Israel.[1]

WindowsAndroid
Malware Enterprise

S0688: Meteor

Meteor is a wiper that was used against Iranian government organizations, including Iranian Railways, the Ministry of Roads, and Urban Development systems, in July 2021. Meteor is likely a newer version of similar wipers called Stardust and Comet that were reportedly used by a group called "Indra" since at least 2019 against private companies in Syria.[1]

Windows
Malware Enterprise

S1212: RansomHub

RansomHub is a ransomware-as-a-service (RaaS) offering with Windows, ESXi, Linux, and FreeBSD versions that has been in use since at least 2024 to target organizations in multiple sectors globally. RansomHub operators may have purchased and rebranded resources from Knight (formerly Cyclops) Ransomware which shares infrastructure, feature, and code overlaps with RansomHub.[1][2]

LinuxWindows
Malware Enterprise

S1068: BlackCat

BlackCat is ransomware written in Rust that has been offered via the Ransomware-as-a-Service (RaaS) model. First observed November 2021, BlackCat has been used to target multiple sectors and organizations in various countries and regions in Africa, the Americas, Asia, Australia, and Europe.[1][2][3]

LinuxWindows
Malware Enterprise

S1242: Qilin

Qilin is a ransomware family operated as a ransomware-as-a-service (RaaS) that has been active since at least 2022. It includes variants written in Go and Rust capable of targeting Windows, Linux, and VMware ESXi environments. Qilin shares functionality overlaps with Black Basta, REvil, and BlackCat ransomware. Qilin affiliates have targeted multiple entities worldwide with the majority of victims in the US, France, Canada, and the UK, primarily in the manufacturing, technology, financial services, and healthcare sectors.[1][2][3][4][5]

ESXiWindowsLinux
Relationship explorer

All related ATT&CK context

detects · Detection Strategy DET0082: Internal Website and System Content Defacement via UI or Messaging Modifications Enterprise uses · Tool S0332: Remcos Enterprise uses · Group G0047: Gamaredon Group Enterprise uses · Malware S1178: ShrinkLocker Enterprise subtechnique of · Technique T1491: Defacement Enterprise uses · Malware S1070: Black Basta Enterprise uses · Malware S0659: Diavol Enterprise uses · Malware S9030: SameCoin Enterprise uses · Group G1043: BlackByte Enterprise uses · Malware S1150: ROADSWEEP Enterprise mitigates · Mitigation M1053: Data Backup Enterprise uses · Malware S0688: Meteor Enterprise uses · Group G0032: Lazarus Group Enterprise uses · Malware S1212: RansomHub Enterprise uses · Malware S1068: BlackCat Enterprise uses · Malware S1242: Qilin Enterprise uses · Malware S1139: INC Ransomware Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1053: Data Backup

Data Backup involves taking and securely storing backups of data from end-user systems and critical servers. It ensures that data remains available in the event of system compromise, ransomware attacks, or other disruptions. Backup processes should include hardening backup systems, implementing secure storage solutions, and keeping backups isolated from the corporate network to prevent compromise during active incidents. This mitigation can be implemented through the following measures:

Regular Backup Scheduling: - Use Case: Ensure timely and consistent backups of critical data. - Implementation: Schedule daily incremental backups and weekly full backups for all critical servers and systems.

Immutable Backups: - Use Case: Protect backups from modification or deletion, even by attackers. - Implementation: Use write-once-read-many (WORM) storage for backups, preventing ransomware from encrypting or deleting backup files.

Backup Encryption: - Use Case: Protect data integrity and confidentiality during transit and storage. - Implementation: Encrypt backups using strong encryption protocols (e.g., AES-256) before storing them in local, cloud, or remote locations.

Offsite Backup Storage: - Use Case: Ensure data availability during physical disasters or onsite breaches. - Implementation: Use cloud-based solutions like AWS S3, Azure Backup, or physical offsite storage to maintain a copy of critical data.

Backup Testing: - Use Case: Validate backup integrity and ensure recoverability. - Implementation: Regularly test data restoration processes to ensure that backups are not corrupted and can be recovered quickly.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
ed6dfb377e5788b4...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.2 Current bundle ed6dfb377e57…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Novetta Blockbuster

    Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.

    Open source URL
  2. [2]
    Varonis

    Jason Hill. (2023, February 8). VMware ESXi in the Line of Ransomware Fire. Retrieved March 26, 2025.

    Open source URL
  3. [3]
    Novetta Blockbuster Destructive Malware

    Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved November 17, 2024.

    Open source URL
  4. [4]
    mitre-attack T1491.001
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use