T1561.001: Disk Content Wipe
Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.
Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.[1][2][3] Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content. To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.[2] Adversaries have also been observed leveraging third-party drivers like RawDisk to directly access disk content.[1][2] This behavior is distinct from Data Destruction because sections of the disk are erased instead of individual files.
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.[2]
Analyst context for executives and security teams
Disk Content Wipe is a destructive impact behavior where an adversary overwrites arbitrary portions of storage so systems, servers, or network devices may become unavailable and data may not be recoverable through normal storage interfaces. For leaders, the key issue is not only malware detection; it is whether the organization can contain destructive activity quickly, preserve identity and lateral movement evidence, and restore critical operations from backups that were not reachable during the incident.
Executive priority
Treat this as an operational resilience and incident readiness problem. ATT&CK maps this sub-technique across Windows, Linux, macOS, and network devices, and relates it to wiper and ransomware tooling as well as propagation patterns that may use valid accounts, credential dumping, and SMB/Windows Admin Shares. Executives should ask whether backup isolation, restoration testing, privileged access controls, and crisis decision processes are strong enough for a destructive event affecting many systems at once.
Technical view
SOC and IR teams should validate visibility for direct disk access, unusual overwrite behavior, suspicious driver loading, and destructive activity on endpoints and network devices. ATT&CK does not provide official detection text for this object, but it does relate DET0316 as a detection strategy and M1053 Data Backup as mitigation. Detection engineering should correlate low-level disk modification signals with process ancestry, new or unusual drivers such as RawDisk-like behavior where applicable, privileged account use, credential access indicators, and lateral movement over administrative shares. IR playbooks should prioritize rapid scoping, isolation, credential containment, and backup integrity checks before restoration.
Likely telemetry
- Endpoint process creation and command-line telemetry on Windows, Linux, and macOS
- Kernel or driver load events, especially drivers capable of raw disk access on Windows
- File, disk, block device, or raw storage write activity where available from EDR, OS audit, or host sensors
- Authentication logs for valid account use, especially privileged or unusual logons
- Credential access alerts or evidence relevant to OS Credential Dumping context
Detection direction
- Because official ATT&CK detection text is not provided, start by operationalizing DET0316 and validating whether current tools can observe direct disk access and overwrite behavior rather than only file deletion.
- Tune detections to distinguish legitimate disk administration, imaging, encryption, backup, and maintenance tools from unusual raw disk modification, unexpected driver use, or destructive execution on non-administrative hosts.
- Correlate destructive disk activity with identity signals: valid account use, abnormal privileged logons, credential dumping indicators, and administrative share access may indicate network-wide impact preparation.
- Include non-Windows coverage. ATT&CK lists Linux, macOS, and network devices in scope; endpoint-only Windows detections may leave major blind spots.
- Review ransomware and wiper-related detections in the context of mapped software such as RawDisk, StoneDrill, MegaCortex, WhisperGate, HermeticWiper, VPNFilter, BlackCat, AcidRain, Apostle, DEADWOOD, AcidPour, and cipher.exe, without assuming those specific tools are present locally.
Mitigation priorities
- Prioritize M1053 Data Backup: maintain regular backups for critical servers and end-user systems, harden backup infrastructure, isolate backup storage from the corporate network, and test restoration under destructive-incident assumptions.
- Reduce blast radius through privileged access governance, strong controls over administrative shares and remote administration paths, and monitoring of valid account use.
- Limit or closely control tools and drivers capable of direct disk modification, especially on systems where such access is not operationally required.
- Prepare IR procedures for rapid host isolation, credential reset decisions, preservation of volatile evidence, and coordinated recovery sequencing.
- Include network devices in resilience planning where business operations depend on routers, modems, or other infrastructure that may not be covered by standard endpoint controls.
Analyst notes and limits
This object is a sub-technique of T1561 Disk Wipe and is distinct from file-level Data Destruction because it focuses on overwriting disk content or arbitrary disk regions. Relationship context shows use by several groups, campaigns, and software families, but those mappings should be treated as ATT&CK context rather than evidence of activity in any specific environment. The strongest defensive value is validating whether destructive raw disk behavior, identity misuse, propagation paths, and backup recoverability are covered together.
The official ATT&CK detection field for this technique is not provided, so detection recommendations are derived from the object description, platforms, tactics, external references, and supplied relationships. Local operating system configuration, EDR capability, network device logging, and backup architecture will determine actual coverage. This take does not assert active exploitation, customer exposure, attribution, or guaranteed detection.
Disk Content Wipe
Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.
Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.[1][2][3] Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content. To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.[2] Adversaries have also been observed leveraging third-party drivers like RawDisk to directly access disk content.[1][2] This behavior is distinct from Data Destruction because sections of the disk are erased instead of individual files.
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.[2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1488 | Disk Content Wipe | Disk Content Wipe revoked by this object. |
| Enterprise | T1561 | Disk Wipe | This object subtechnique of Disk Wipe. |
Groups, software, and campaigns
G1055: VOID MANTICORE
VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).[1] Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.[1][2] VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.[1][3] VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.[4]
G0032: Lazarus Group
Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]
North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]
G0047: Gamaredon Group
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]
In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]
S1205: cipher.exe
cipher.exe is a native Microsoft utility that manages encryption of directories and files on NTFS (New Technology File System) partitions by using the Encrypting File System (EFS).[1]
S1134: DEADWOOD
S1125: AcidRain
AcidRain is an ELF binary targeting modems and routers using MIPS architecture.[1] AcidRain is associated with the ViaSat KA-SAT communication outage that took place during the initial phases of the 2022 full-scale invasion of Ukraine. Analysis indicates overlap with another network device-targeting malware, VPNFilter, associated with Sandworm Team.[1] US and European government sources linked AcidRain to Russian government entities, while Ukrainian government sources linked AcidRain specifically to Sandworm Team.[2][3]
S0689: WhisperGate
WhisperGate is a multi-stage wiper designed to look like ransomware that has been used against multiple government, non-profit, and information technology organizations in Ukraine since at least January 2022.[1][2][3]
S0364: RawDisk
RawDisk is a legitimate commercial driver from the EldoS Corporation that is used for interacting with files, disks, and partitions. The driver allows for direct modification of data on a local computer's hard drive. In some cases, the tool can enact these raw disk modifications from user-mode processes, circumventing Windows operating system security features.[1][2]
S0576: MegaCortex
MegaCortex is ransomware that first appeared in May 2019. [1] MegaCortex has mainly targeted industrial organizations. [2][3]
S1167: AcidPour
AcidPour is a variant of AcidRain designed to impact a wider range of x86 architecture Linux devices. AcidPour is an x86 ELF binary that expands on the targeted devices and locations in AcidRain by including items such as Unsorted Block Image (UBI), Deice Mapper (DM), and various flash memory references. Based on this expanded targeting, AcidPour can impact a variety of device types including IoT, networking, and ICS embedded device types.[1] AcidPour is a wiping payload associated with the Sandworm Team threat actor, and potentially linked to attacks against Ukrainian internet service providers (ISPs) in 2023.[2]
S1133: Apostle
Apostle is malware that has functioned as both a wiper and, in more recent versions, as ransomware. Apostle is written in .NET and shares various programming and functional overlaps with IPsec Helper.[1]
S1010: VPNFilter
VPNFilter is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. VPNFilter modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. [1] [2] VPNFilter was assessed to be replaced by Sandworm Team with Cyclops Blink starting in 2019.[3]
S0380: StoneDrill
StoneDrill is wiper malware discovered in destructive campaigns against both Middle Eastern and European targets in association with APT33.[1][2]
S0697: HermeticWiper
S1068: BlackCat
BlackCat is ransomware written in Rust that has been offered via the Ransomware-as-a-Service (RaaS) model. First observed November 2021, BlackCat has been used to target multiple sectors and organizations in various countries and regions in Africa, the Americas, Asia, Australia, and Europe.[1][2][3]
C0051: APT28 Nearest Neighbor Campaign
APT28 Nearest Neighbor Campaign was conducted by APT28 from early February 2022 to November 2024 against organizations and individuals with expertise on Ukraine. APT28 primarily leveraged living-off-the-land techniques, while leveraging the zero-day exploitation of CVE-2022-38028. Notably, APT28 leveraged Wi-Fi networks in close proximity to the intended target to gain initial access to the victim environment. By daisy-chaining multiple compromised organizations nearby the intended target, APT28 discovered dual-homed systems (with both a wired and wireless network connection) to enable Wi-Fi and use compromised credentials to connect to the victim network.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 3a947e589d6e… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Novetta Blockbuster
Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
Open source URL -
[2]
Novetta Blockbuster Destructive Malware
Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved November 17, 2024.
Open source URL -
[3]
DOJ Lazarus Sony 2018
Department of Justice. (2018, September 6). Criminal Complaint - United States of America v. PARK JIN HYOK. Retrieved March 29, 2019.
Open source URL -
[4]
Microsoft Sysmon v6 May 2017
Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved December 13, 2017.
Open source URL -
[5]
mitre-attack T1561.001Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.