LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1485: Data Destruction

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.[1][2][3][4][5][6] Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.[4][5] In some cases politically oriented image files have been used to overwrite data.[2][3][4]

To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.[1][2][3][4][6].

In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.[7][8] Similarly, they may delete virtual machines from on-prem virtualized environments.

EnterpriseT1485TechniqueObject v1.4Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Data Destruction is an availability-impact behavior where adversaries destroy files, cloud objects, virtual machines, databases, images, or other operational data so the business cannot recover through normal forensic or undelete methods. For leaders, this is not just a malware issue; it is a resilience test of identity controls, backup isolation, cloud permissions, hypervisor administration, and incident recovery decision-making.

Executive priority

Treat this technique as a business-continuity and recovery-risk priority. ATT&CK links it to destructive campaigns, wiper malware, cloud object deletion, and virtual machine deletion across Windows, Linux, macOS, ESXi, containers, and IaaS. Executives should ask whether critical data and infrastructure can be restored if privileged accounts, cloud lifecycle policies, admin shares, or virtualized environments are abused. Budget and audit focus should prioritize least privilege, MFA, account lifecycle governance, and hardened, isolated backups.

Technical view

SOC, detection engineering, and IR teams should validate coverage for mass overwrite and deletion behavior across endpoint, server, cloud, and virtualization planes. Because official ATT&CK detection text is not provided, use the related detection strategy DET0146 as direction: look for high-volume file deletion, overwrite, or destructive modification patterns rather than relying only on malware signatures. ATT&CK context also notes that destructive tooling may propagate using Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares, so identity and lateral movement evidence should be reviewed alongside file-system impact events.

Likely telemetry

  • Endpoint process creation and command execution for deletion or overwrite activity on Windows, Linux, and macOS
  • File-system audit events showing bulk deletion, overwrite, rename, or modification of many files or directories
  • EDR or host telemetry for secure-delete tools, wiper-like behavior, and abnormal raw disk or file manipulation
  • Cloud audit logs for deletion of storage objects, machine images, database instances, infrastructure resources, and lifecycle policy changes
  • IaaS, ESXi, and virtualization management logs for virtual machine deletion or destructive administrative actions

Detection direction

  • Baseline normal administrative deletion patterns so mass deletion or overwrite behavior can be separated from maintenance, deployment, retention, and backup jobs.
  • Correlate destructive file activity with account context, privilege level, source host, remote access path, and recent authentication events.
  • In cloud environments, alert on high-risk deletion of storage objects, images, databases, and infrastructure resources, including lifecycle-triggered deletion where applicable through sub-technique T1485.001.
  • For ESXi and IaaS, validate whether security monitoring receives management-plane events, not only guest operating system telemetry.
  • Tune detections to reduce false positives from legitimate cleanup, retention, and decommissioning workflows while preserving high-severity escalation for broad, rapid, or privileged deletion.

Mitigation priorities

  • Prioritize Data Backup (M1053): maintain securely stored, hardened, and isolated backups for critical endpoints, servers, cloud assets, databases, and virtualized environments.
  • Implement User Account Management (M1018): enforce least privilege, remove stale access, and tightly govern accounts that can delete data, change lifecycle policies, or administer virtualization and cloud resources.
  • Require Multi-factor Authentication (M1032) for critical systems, privileged access, and cloud/IaaS control planes where destructive actions can be performed.
  • Review cloud and virtualization permissions for delete rights on storage objects, machine images, database instances, and virtual machines.
  • Exercise recovery procedures so incident commanders know what can be restored, from where, and how quickly if data destruction occurs.
Additional notes and limits

This technique is materially important because it targets availability directly and can affect enterprise endpoints, servers, cloud services, containers, ESXi, and IaaS. Relationship context connects it to destructive malware and multiple campaigns/groups, but those relationships should be used for threat-modeling and detection prioritization, not as proof of local exposure. The most useful defensive question is whether destructive actions would be prevented, detected, contained, and recovered before business operations are materially interrupted.

MITRE does not provide official detection text for this object, and the related detection strategy is named but not detailed in the supplied fields. Local telemetry availability, retention, privileged access design, cloud architecture, and backup recoverability must be verified in the environment before making coverage claims.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Data Destruction

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.[1][2][3][4][5][6] Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.[4][5] In some cases politically oriented image files have been used to overwrite data.[2][3][4]

To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.[1][2][3][4][6].

In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.[7][8] Similarly, they may delete virtual machines from on-prem virtualized environments.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
DomainIDNameRelationship / procedure
EnterpriseT1485.001Lifecycle-Triggered DeletionSub-techniqueLifecycle-Triggered Deletion subtechnique of this object.
Associated objects

Groups, software, and campaigns

GroupEnterprise

G1004: LAPSUS$

LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.[1][2][3]

GroupEnterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

GroupEnterprise

G1053: Storm-0501

Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.[1][2][3][4]

GroupEnterprise

G0082: APT38

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.[1] Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext [2] and Banco de Chile [2]; some of their attacks have been destructive.[1][2][3][4]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

GroupEnterprise

G0034: Sandworm Team

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.[1][2] This group has been active since at least 2009.[3][4][5][6]

In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.[1][2] Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.[7]

GroupEnterprise

G1055: VOID MANTICORE

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).[1] Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.[1][2] VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.[1][3] VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.[4]

MalwareEnterprise

S0659: Diavol

Diavol is a ransomware variant first observed in June 2021 that is capable of prioritizing file types to encrypt based on a pre-configured list of extensions defined by the attacker. The Diavol Ransomware-as-a Service (RaaS) program is managed by Wizard Spider and it has been observed being deployed by Bazar.[1][2][3][4]

Windows
MalwareEnterprise

S0689: WhisperGate

WhisperGate is a multi-stage wiper designed to look like ransomware that has been used against multiple government, non-profit, and information technology organizations in Ukraine since at least January 2022.[1][2][3]

Windows
MalwareEnterprise

S0604: Industroyer

Industroyer is a sophisticated malware framework designed to cause an impact to the working processes of Industrial Control Systems (ICS), specifically components used in electrical substations.[1] Industroyer was used in the attacks on the Ukrainian power grid in December 2016.[2] This is the first publicly known malware specifically designed to target and impact operations in the electric grid.[3]

Windows
MalwareEnterprise

S0341: Xbash

Xbash is a malware family that has targeted Linux and Microsoft Windows servers. The malware has been tied to the Iron Group, a threat actor group known for previous ransomware attacks. Xbash was developed in Python and then converted into a self-contained Linux ELF executable by using PyInstaller.[1]

WindowsLinux
MalwareEnterprise

S1125: AcidRain

AcidRain is an ELF binary targeting modems and routers using MIPS architecture.[1] AcidRain is associated with the ViaSat KA-SAT communication outage that took place during the initial phases of the 2022 full-scale invasion of Ukraine. Analysis indicates overlap with another network device-targeting malware, VPNFilter, associated with Sandworm Team.[1] US and European government sources linked AcidRain to Russian government entities, while Ukrainian government sources linked AcidRain specifically to Sandworm Team.[2][3]

Network DevicesLinux
MalwareEnterprise

S9008: Shai-Hulud

Shai-Hulud is a supply chain worm, first reported in September 2025, that spreads through code repositories, including GitHub and NPM packages. It exploits CI/CD pipeline dependencies to propagate to victims and poisons the supply chain by publishing malicious packages. Once inside a victim environment, Shai-Hulud steals credentials and access tokens from compromised repository accounts and exfiltrates them to attacker-controlled servers via encoded GitHub Actions workflows.[1][2][3][4][5][6][7]

LinuxSaaSWindows
MalwareEnterprise

S0496: REvil

REvil is a ransomware family that has been linked to the GOLD SOUTHFIELD group and operated as ransomware-as-a-service (RaaS) since at least April 2019. REvil, which as been used against organizations in the manufacturing, transportation, and electric sectors, is highly configurable and shares code similarities with the GandCrab RaaS.[1][2][3]

Windows
MalwareEnterprise

S0265: Kazuar

Kazuar is a fully featured, multi-platform backdoor Trojan written using the Microsoft .NET framework. [1]

WindowsmacOS
MalwareEnterprise

S9038: DynoWiper

DynoWiper is a destructive malware associated with the 2025 Poland Wiper Attacks in December of 2025. DynoWiper is a native Windows binary that is distributed by a PowerShell script and overwrites files using data generated by the Mersenne Twister algorithm before they are deleted from the system. Multiple variants of DynoWiper have been identified, with the primary differences being that one variant shuts down the system after completing its destructive operations, and another introduces a time delay between file overwriting and deletion.[1][2]

Windows
MalwareEnterprise

S0697: HermeticWiper

HermeticWiper is a data wiper that has been used since at least early 2022, primarily against Ukraine with additional activity observed in Latvia and Lithuania. Some sectors targeted include government, financial, defense, aviation, and IT services.[1][2][3][4][5]

Windows
MalwareEnterprise

S9030: SameCoin

SameCoin is a multi-platform wiper with Windows and Android versions that has been used by WIRTE to target entities in the Middle East including in Israel.[1]

WindowsAndroid
MalwareEnterprise

S1134: DEADWOOD

DEADWOOD is wiper malware written in C++ using Boost libraries. DEADWOOD was first observed in an unattributed wiping event in Saudi Arabia in 2019, and has since been incorporated into Agrius operations.[1]

Windows
CampaignEnterprise

C0063: 2025 Poland Wiper Attacks

2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, DynoWiper, a Windows-based wiper and LazyWiper, a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group Dragonfly, also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as Sandworm Team.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · MalwareS0659: DiavolEnterpriseuses · MalwareS0689: WhisperGateEnterpriseuses · MalwareS0604: IndustroyerEnterpriseuses · GroupG1004: LAPSUS$Enterpriseuses · MalwareS0341: XbashEnterpriseuses · GroupG0032: Lazarus GroupEnterpriseuses · MalwareS1125: AcidRainEnterprisesubtechnique of · TechniqueT1485.001: Lifecycle-Triggered DeletionEnterpriseuses · MalwareS9008: Shai-HuludEnterpriseuses · MalwareS0496: REvilEnterprisedetects · Detection StrategyDET0146: Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion PatternsEnterpriseuses · MalwareS0265: KazuarEnterpriseuses · GroupG1053: Storm-0501Enterpriseuses · MalwareS9038: DynoWiperEnterpriseuses · MalwareS0697: HermeticWiperEnterpriseuses · MalwareS9030: SameCoinEnterpriseuses · MalwareS1134: DEADWOODEnterpriseuses · MalwareS0140: ShamoonEnterpriseuses · MalwareS0139: PowerDukeEnterpriseuses · CampaignC0034: 2022 Ukraine Electric Power AttackEnterpriseuses · MalwareS0365: Olympic DestroyerEnterpriseuses · GroupG0082: APT38Enterpriseuses · MalwareS1135: MultiLayer WiperEnterpriseuses · MalwareS0693: CaddyWiperEnterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1032: Multi-factor Authentication

Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include:

- *Something you know*: Passwords, PINs. - *Something you have*: Physical tokens, smartphone authenticator apps. - *Something you are*: Biometric data such as fingerprints, facial recognition, or retinal scans.

Implementing MFA across all critical systems and services ensures robust protection against account takeover and unauthorized access. This mitigation can be implemented through the following measures:

Identity and Access Management (IAM):

- Use IAM solutions like Azure Active Directory, Okta, or AWS IAM to enforce MFA policies for all user logins, especially for privileged roles. - Enable conditional access policies to enforce MFA for risky sign-ins (e.g., unfamiliar devices, geolocations). - Enable Conditional Access policies to only allow logins from trusted devices, such as those enrolled in Intune or joined via Hybrid/Entra.

Authentication Tools and Methods:

- Use authenticator applications such as Google Authenticator, Microsoft Authenticator, or Authy for time-based one-time passwords (TOTP). - Deploy hardware-based tokens like YubiKey, RSA SecurID, or smart cards for additional security. - Enforce biometric authentication for compatible devices and applications.

Secure Legacy Systems:

- Integrate MFA solutions with older systems using third-party tools like Duo Security or Thales SafeNet. - Enable RADIUS/NPS servers to facilitate MFA for VPNs, RDP, and other network logins.

Monitoring and Alerting:

- Use SIEM tools to monitor failed MFA attempts, login anomalies, or brute-force attempts against MFA systems. - Implement alerts for suspicious MFA activities, such as repeated failed codes or new device registrations.

Training and Policy Enforcement:

- Educate employees on the importance of MFA and secure authenticator usage. - Enforce policies that require MFA on all critical systems, especially for remote access, privileged accounts, and cloud applications.

MitigationEnterprise

M1053: Data Backup

Data Backup involves taking and securely storing backups of data from end-user systems and critical servers. It ensures that data remains available in the event of system compromise, ransomware attacks, or other disruptions. Backup processes should include hardening backup systems, implementing secure storage solutions, and keeping backups isolated from the corporate network to prevent compromise during active incidents. This mitigation can be implemented through the following measures:

Regular Backup Scheduling: - Use Case: Ensure timely and consistent backups of critical data. - Implementation: Schedule daily incremental backups and weekly full backups for all critical servers and systems.

Immutable Backups: - Use Case: Protect backups from modification or deletion, even by attackers. - Implementation: Use write-once-read-many (WORM) storage for backups, preventing ransomware from encrypting or deleting backup files.

Backup Encryption: - Use Case: Protect data integrity and confidentiality during transit and storage. - Implementation: Encrypt backups using strong encryption protocols (e.g., AES-256) before storing them in local, cloud, or remote locations.

Offsite Backup Storage: - Use Case: Ensure data availability during physical disasters or onsite breaches. - Implementation: Use cloud-based solutions like AWS S3, Azure Backup, or physical offsite storage to maintain a copy of critical data.

Backup Testing: - Use Case: Validate backup integrity and ensure recoverability. - Implementation: Regularly test data restoration processes to ensure that backups are not corrupted and can be recovered quickly.

MitigationEnterprise

M1018: User Account Management

User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures:

Enforcing the Principle of Least Privilege

- Implementation: Assign users only the minimum permissions required to perform their job functions. Regularly audit accounts to ensure no excess permissions are granted. - Use Case: Reduces the risk of privilege escalation by ensuring accounts cannot perform unauthorized actions.

Implementing Strong Password Policies

- Implementation: Enforce password complexity requirements (e.g., length, character types). Require password expiration every 90 days and disallow password reuse. - Use Case: Prevents adversaries from gaining unauthorized access through password guessing or brute force attacks.

Managing Dormant and Orphaned Accounts

- Implementation: Implement automated workflows to disable accounts after a set period of inactivity (e.g., 30 days). Remove orphaned accounts (e.g., accounts without an assigned owner) during regular account audits. - Use Case: Eliminates dormant accounts that could be exploited by attackers.

Account Lockout Policies

- Implementation: Configure account lockout thresholds (e.g., lock accounts after five failed login attempts). Set lockout durations to a minimum of 15 minutes. - Use Case: Mitigates automated attack techniques that rely on repeated login attempts.

Multi-Factor Authentication (MFA) for High-Risk Accounts

- Implementation: Require MFA for all administrative accounts and high-risk users. Use MFA mechanisms like hardware tokens, authenticator apps, or biometrics. - Use Case: Prevents unauthorized access, even if credentials are stolen.

Restricting Interactive Logins

- Implementation: Restrict interactive logins for privileged accounts to specific secure systems or management consoles. Use group policies to enforce logon restrictions. - Use Case: Protects sensitive accounts from misuse or exploitation.

*Tools for Implementation*

Built-in Tools:

- Microsoft Active Directory (AD): Centralized account management and RBAC enforcement. - Group Policy Object (GPO): Enforce password policies, logon restrictions, and account lockout policies.

Identity and Access Management (IAM) Tools:

- Okta: Centralized user provisioning, MFA, and SSO integration. - Microsoft Azure Active Directory: Provides advanced account lifecycle management, role-based access, and conditional access policies.

Privileged Account Management (PAM): - CyberArk, BeyondTrust, Thycotic: Manage and monitor privileged account usage, enforce session recording, and JIT access.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.4
Created
Modified
Raw hash
a07716e68fe20895...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.4Current bundlea07716e68fe2…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Symantec Shamoon 2012

    Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019.

    Open source URL
  2. [2]
    FireEye Shamoon Nov 2016

    FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved November 17, 2024.

    Open source URL
  3. [3]
    Palo Alto Shamoon Nov 2016

    Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.

  4. [4]
    Kaspersky StoneDrill 2017

    Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.

    Open source URL
  5. [5]
    Unit 42 Shamoon3 2018

    Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.

    Open source URL
  6. [6]
    Talos Olympic Destroyer 2018

    Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.

    Open source URL
  7. [7]
    Data Destruction - Threat Post

    Mimoso, M.. (2014, June 18). Hacker Puts Hosting Service Code Spaces Out of Business. Retrieved December 15, 2020.

    Open source URL
  8. [8]
    DOJ - Cisco Insider

    DOJ. (2020, August 26). San Jose Man Pleads Guilty To Damaging Cisco’s Network. Retrieved December 15, 2020.

    Open source URL
  9. [9]
    Fortinet Diavol July 2021

    Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.

    Open source URL
  10. [10]
    Microsoft WhisperGate January 2022

    MSTIC. (2022, January 15). Destructive malware targeting Ukrainian organizations. Retrieved March 10, 2022.

    Open source URL
  11. [11]
    Crowdstrike WhisperGate January 2022

    Crowdstrike. (2022, January 19). Technical Analysis of the WhisperGate Malicious Bootloader. Retrieved March 10, 2022.

    Open source URL
  12. [12]
    Cybereason WhisperGate February 2022

    Cybereason Nocturnus. (2022, February 15). Cybereason vs. WhisperGate and HermeticWiper. Retrieved March 10, 2022.

    Open source URL
  13. [13]
    Unit 42 WhisperGate January 2022

    Falcone, R. et al.. (2022, January 20). Threat Brief: Ongoing Russia and Ukraine Cyber Conflict. Retrieved March 10, 2022.

    Open source URL
  14. [14]
    Cisco Ukraine Wipers January 2022

    Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022.

    Open source URL
  15. [15]
    Medium S2W WhisperGate January 2022

    S2W. (2022, January 18). Analysis of Destructive Malware (WhisperGate) targeting Ukraine. Retrieved March 14, 2022.

    Open source URL
  16. [16]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  17. [17]
    MSTIC DEV-0537 Mar 2022

    MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.

    Open source URL
  18. [18]
    NCC Group LAPSUS Apr 2022

    Brown, D., et al. (2022, April 28). LAPSUS$: Recent techniques, tactics and procedures. Retrieved December 22, 2022.

    Open source URL
  19. [19]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  20. [20]
    Novetta Blockbuster

    Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.

    Open source URL
  21. [21]
    AcidRain JAGS 2022

    Juan Andres Guerrero-Saade and Max van Amerongen, SentinelOne. (2022, March 31). AcidRain | A Modem Wiper Rains Down on Europe. Retrieved March 25, 2024.

    Open source URL
  22. [22]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  23. [23]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  24. [24]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  25. [25]
    Kaspersky Sodin July 2019

    Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.

    Open source URL
  26. [26]
    Secureworks GandCrab and REvil September 2019

    Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.

    Open source URL
  27. [27]
    McAfee Sodinokibi October 2019

    McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.

    Open source URL
  28. [28]
    Intel 471 REvil March 2020

    Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.

    Open source URL
  29. [29]
    Picus Sodinokibi January 2020

    Ozarslan, S. (2020, January 15). A Brief History of Sodinokibi. Retrieved August 5, 2020.

    Open source URL
  30. [30]
    Secureworks REvil September 2019

    Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.

    Open source URL
  31. [31]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  32. [32]
    Microsoft Storm-0501 Embargo Ransomware August 2025

    Microsoft Threat Intelligence. (2025, August 27). Storm-0501’s evolving techniques lead to cloud-based ransomware. Retrieved October 19, 2025.

    Open source URL
  33. [33]
    CERT Polska

    CERT Polska. (2026, January 30). Energy Sector Incident Report – 29 December. Retrieved April 22, 2026.

    Open source URL
  34. [34]
    ESET DynoWiper Update JAN 2026

    ESET. (2026, January 30). DynoWiper update: Technical analysis and attribution. Retrieved April 22, 2026.

    Open source URL
  35. [35]
    ESET Hermetic Wizard March 2022

    ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.

    Open source URL
  36. [36]
    Check Point Wirte NOV 2024

    Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.

    Open source URL
  37. [37]
    SentinelOne Agrius 2021

    Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.

    Open source URL
  38. [38]
    McAfee Shamoon December 2018

    Mundo, A., Roccia, T., Saavedra-Morales, J., Beek, C.. (2018, December 14). Shamoon Returns to Wipe Systems in Middle East, Europe . Retrieved May 29, 2020.

    Open source URL
  39. [39]
    Volexity PowerDuke November 2016

    Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.

    Open source URL
  40. [40]
    Mandiant-Sandworm-Ukraine-2022

    Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.

    Open source URL
  41. [41]
    US District Court Indictment GRU Unit 74455 October 2020

    Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.

    Open source URL
  42. [42]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  43. [43]
    Unit42 Agrius 2023

    Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.

    Open source URL
  44. [44]
    ESET CaddyWiper March 2022

    ESET. (2022, March 15). CaddyWiper: New wiper malware discovered in Ukraine. Retrieved March 23, 2022.

    Open source URL
  45. [45]
    Cisco CaddyWiper March 2022

    Malhotra, A. (2022, March 15). Threat Advisory: CaddyWiper. Retrieved March 23, 2022.

    Open source URL
  46. [46]
    Ready.gov IT DRP

    Ready.gov. (n.d.). IT Disaster Recovery Plan. Retrieved March 15, 2019.

    Open source URL
  47. [47]
    ESET DynoWiper JAN 2026

    ESET. (2026, January 30). Russian Sandworm group attacks energy company in Poland with DynoWiper, ESET Research discovers. Retrieved April 22, 2026.

    Open source URL
  48. [48]
    Microsoft SDelete July 2016

    Russinovich, M. (2016, July 4). SDelete v2.0. Retrieved February 8, 2018.

    Open source URL
  49. [49]
    Securelist BlackEnergy Feb 2015

    Baumgartner, K. and Garnaeva, M.. (2015, February 17). BE2 extraordinary plugins, Siemens targeting, dev fails. Retrieved March 24, 2016.

    Open source URL
  50. [50]
    ESET BlackEnergy Jan 2016

    Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry . Retrieved June 10, 2020.

    Open source URL
  51. [51]
    Check Point Meteor Aug 2021

    Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.

    Open source URL
  52. [52]
    ESEST Black Energy Jan 2016

    Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry. Retrieved May 18, 2016.

  53. [53]
    Splunk ShrinkLocker 2024

    Splunk Threat Research Team , Teoderick Contreras. (2024, September 5). ShrinkLocker Malware: Abusing BitLocker to Lock Your Data. Retrieved December 7, 2024.

    Open source URL
  54. [54]
    US-CERT Ukraine Feb 2016

    US-CERT. (2016, February 25). ICS Alert (IR-ALERT-H-16-056-01) Cyber-Attack Against Ukrainian Critical Infrastructure. Retrieved June 10, 2020.

    Open source URL
  55. [55]
    ESET Telebots June 2017

    Cherepanov, A.. (2017, June 30). TeleBots are back: Supply chain attacks against Ukraine. Retrieved June 11, 2020.

    Open source URL
  56. [56]
    mandiant_apt44_unearthing_sandworm

    Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.

    Open source URL
  57. [57]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  58. [58]
    SPECOPS Outpost24 Handala Hack Stryker March 2026

    David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.

    Open source URL
  59. [59]
    DOJ FBI Handala Hack March 2026

    DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.

    Open source URL
  60. [60]
    Palo Alto VOID MANTICORE Iran Cyber Threats March 2026

    Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.

    Open source URL
  61. [61]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  62. [62]
    SentinelOne AcidPour 2024

    Juan Andrés Guerrero-Saade & Tom Hegel. (2024, March 21). AcidPour | New Embedded Wiper Variant of AcidRain Appears in Ukraine. Retrieved November 25, 2024.

    Open source URL
  63. [63]
    DOJ - Cisco Insider

    DOJ. (2020, August 26). San Jose Man Pleads Guilty To Damaging Cisco’s Network. Retrieved December 15, 2020.

    Open source URL
  64. [64]
    DOJ - Cisco Insider

    DOJ. (2020, August 26). San Jose Man Pleads Guilty To Damaging Cisco’s Network. Retrieved December 15, 2020.

    Open source URL
  65. [65]
    Data Destruction - Threat Post

    Mimoso, M.. (2014, June 18). Hacker Puts Hosting Service Code Spaces Out of Business. Retrieved December 15, 2020.

    Open source URL
  66. [66]
    Data Destruction - Threat Post

    Mimoso, M.. (2014, June 18). Hacker Puts Hosting Service Code Spaces Out of Business. Retrieved December 15, 2020.

    Open source URL
  67. [67]
    FireEye Shamoon Nov 2016

    FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved November 17, 2024.

    Open source URL
  68. [68]
    FireEye Shamoon Nov 2016

    FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved November 17, 2024.

    Open source URL
  69. [69]
    Kaspersky StoneDrill 2017

    Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.

    Open source URL
  70. [70]
    Kaspersky StoneDrill 2017

    Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.

    Open source URL
  71. [71]
    Palo Alto Shamoon Nov 2016

    Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.

  72. [72]
    Palo Alto Shamoon Nov 2016

    Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.

  73. [73]
    Symantec Shamoon 2012

    Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019.

    Open source URL
  74. [74]
    Symantec Shamoon 2012

    Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019.

    Open source URL
  75. [75]
    Talos Olympic Destroyer 2018

    Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.

    Open source URL
  76. [76]
    Talos Olympic Destroyer 2018

    Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.

    Open source URL
  77. [77]
    Unit 42 Shamoon3 2018

    Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.

    Open source URL
  78. [78]
    Unit 42 Shamoon3 2018

    Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.

    Open source URL
  79. [79]
    mitre-attackT1485
    Open source URL
  80. [80]
    mitre-attackT1485
    Open source URL
  81. [81]
    mitre-attackT1485
    Open source URL
  82. [82]
    Fortinet Diavol July 2021

    Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.

    Open source URL
  83. [83]
    Cisco Ukraine Wipers January 2022

    Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022.

    Open source URL
  84. [84]
    Crowdstrike WhisperGate January 2022

    Crowdstrike. (2022, January 19). Technical Analysis of the WhisperGate Malicious Bootloader. Retrieved March 10, 2022.

    Open source URL
  85. [85]
    Cybereason WhisperGate February 2022

    Cybereason Nocturnus. (2022, February 15). Cybereason vs. WhisperGate and HermeticWiper. Retrieved March 10, 2022.

    Open source URL
  86. [86]
    Medium S2W WhisperGate January 2022

    S2W. (2022, January 18). Analysis of Destructive Malware (WhisperGate) targeting Ukraine. Retrieved March 14, 2022.

    Open source URL
  87. [87]
    Microsoft WhisperGate January 2022

    MSTIC. (2022, January 15). Destructive malware targeting Ukrainian organizations. Retrieved March 10, 2022.

    Open source URL
  88. [88]
    Unit 42 WhisperGate January 2022

    Falcone, R. et al.. (2022, January 20). Threat Brief: Ongoing Russia and Ukraine Cyber Conflict. Retrieved March 10, 2022.

    Open source URL
  89. [89]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  90. [90]
    MSTIC DEV-0537 Mar 2022

    MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.

    Open source URL
  91. [91]
    NCC Group LAPSUS Apr 2022

    Brown, D., et al. (2022, April 28). LAPSUS$: Recent techniques, tactics and procedures. Retrieved December 22, 2022.

    Open source URL
  92. [92]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  93. [93]
    Novetta Blockbuster

    Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.

    Open source URL
  94. [94]
    AcidRain JAGS 2022

    Juan Andres Guerrero-Saade and Max van Amerongen, SentinelOne. (2022, March 31). AcidRain | A Modem Wiper Rains Down on Europe. Retrieved March 25, 2024.

    Open source URL
  95. [95]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  96. [96]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  97. [97]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  98. [98]
    Intel 471 REvil March 2020

    Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.

    Open source URL
  99. [99]
    Kaspersky Sodin July 2019

    Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.

    Open source URL
  100. [100]
    McAfee Sodinokibi October 2019

    McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.

    Open source URL
  101. [101]
    McAfee Sodinokibi October 2019

    McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.

    Open source URL
  102. [102]
    McAfee Sodinokibi October 2019

    McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.

    Open source URL
  103. [103]
    Picus Sodinokibi January 2020

    Ozarslan, S. (2020, January 15). A Brief History of Sodinokibi. Retrieved August 5, 2020.

    Open source URL
  104. [104]
    Secureworks GandCrab and REvil September 2019

    Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.

    Open source URL
  105. [105]
    Secureworks REvil September 2019

    Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.

    Open source URL
  106. [106]
    Unit 42 Kazuar May 2017

    Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

    Open source URL
  107. [107]
    Microsoft Storm-0501 Embargo Ransomware August 2025

    Microsoft Threat Intelligence. (2025, August 27). Storm-0501’s evolving techniques lead to cloud-based ransomware. Retrieved October 19, 2025.

    Open source URL
  108. [108]
    CERT Polska

    CERT Polska. (2026, January 30). Energy Sector Incident Report – 29 December. Retrieved April 22, 2026.

    Open source URL
  109. [109]
    ESET DynoWiper Update JAN 2026

    ESET. (2026, January 30). DynoWiper update: Technical analysis and attribution. Retrieved April 22, 2026.

    Open source URL
  110. [110]
    ESET Hermetic Wizard March 2022

    ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.

    Open source URL
  111. [111]
    Check Point Wirte NOV 2024

    Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.

    Open source URL
  112. [112]
    SentinelOne Agrius 2021

    Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.

    Open source URL
  113. [113]
    FireEye Shamoon Nov 2016

    FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved November 17, 2024.

    Open source URL
  114. [114]
    FireEye Shamoon Nov 2016

    FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved November 17, 2024.

    Open source URL
  115. [115]
    McAfee Shamoon December 2018

    Mundo, A., Roccia, T., Saavedra-Morales, J., Beek, C.. (2018, December 14). Shamoon Returns to Wipe Systems in Middle East, Europe . Retrieved May 29, 2020.

    Open source URL
  116. [116]
    Palo Alto Shamoon Nov 2016

    Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.

  117. [117]
    Palo Alto Shamoon Nov 2016

    Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.

  118. [118]
    Symantec Shamoon 2012

    Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019.

    Open source URL
  119. [119]
    Symantec Shamoon 2012

    Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019.

    Open source URL
  120. [120]
    Unit 42 Shamoon3 2018

    Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.

    Open source URL
  121. [121]
    Unit 42 Shamoon3 2018

    Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.

    Open source URL
  122. [122]
    Volexity PowerDuke November 2016

    Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.

    Open source URL
  123. [123]
    Mandiant-Sandworm-Ukraine-2022

    Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.

    Open source URL
  124. [124]
    Talos Olympic Destroyer 2018

    Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.

    Open source URL
  125. [125]
    Talos Olympic Destroyer 2018

    Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.

    Open source URL
  126. [126]
    US District Court Indictment GRU Unit 74455 October 2020

    Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.

    Open source URL
  127. [127]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  128. [128]
    Unit42 Agrius 2023

    Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.

    Open source URL
  129. [129]
    Cisco CaddyWiper March 2022

    Malhotra, A. (2022, March 15). Threat Advisory: CaddyWiper. Retrieved March 23, 2022.

    Open source URL
  130. [130]
    ESET CaddyWiper March 2022

    ESET. (2022, March 15). CaddyWiper: New wiper malware discovered in Ukraine. Retrieved March 23, 2022.

    Open source URL
  131. [131]
    Ready.gov IT DRP

    Ready.gov. (n.d.). IT Disaster Recovery Plan. Retrieved March 15, 2019.

    Open source URL
  132. [132]
    CERT Polska

    CERT Polska. (2026, January 30). Energy Sector Incident Report – 29 December. Retrieved April 22, 2026.

    Open source URL
  133. [133]
    CERT Polska

    CERT Polska. (2026, January 30). Energy Sector Incident Report – 29 December. Retrieved April 22, 2026.

    Open source URL
  134. [134]
    ESET DynoWiper JAN 2026

    ESET. (2026, January 30). Russian Sandworm group attacks energy company in Poland with DynoWiper, ESET Research discovers. Retrieved April 22, 2026.

    Open source URL
  135. [135]
    ESET DynoWiper Update JAN 2026

    ESET. (2026, January 30). DynoWiper update: Technical analysis and attribution. Retrieved April 22, 2026.

    Open source URL
  136. [136]
    ESET DynoWiper Update JAN 2026

    ESET. (2026, January 30). DynoWiper update: Technical analysis and attribution. Retrieved April 22, 2026.

    Open source URL
  137. [137]
    Microsoft SDelete July 2016

    Russinovich, M. (2016, July 4). SDelete v2.0. Retrieved February 8, 2018.

    Open source URL
  138. [138]
    ESET BlackEnergy Jan 2016

    Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry . Retrieved June 10, 2020.

    Open source URL
  139. [139]
    Securelist BlackEnergy Feb 2015

    Baumgartner, K. and Garnaeva, M.. (2015, February 17). BE2 extraordinary plugins, Siemens targeting, dev fails. Retrieved March 24, 2016.

    Open source URL
  140. [140]
    Palo Alto Shamoon Nov 2016

    Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.

  141. [141]
    Palo Alto Shamoon Nov 2016

    Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.

  142. [142]
    Unit 42 Shamoon3 2018

    Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.

    Open source URL
  143. [143]
    Unit 42 Shamoon3 2018

    Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.

    Open source URL
  144. [144]
    Mandiant-Sandworm-Ukraine-2022

    Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.

    Open source URL
  145. [145]
    SentinelOne Agrius 2021

    Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.

    Open source URL
  146. [146]
    Kaspersky StoneDrill 2017

    Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use