T1486: Data Encrypted for Impact
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.CitationUS-CERT Ransomware 2016CitationFireEye WannaCry 2017CitationUS-CERT NotPetya 2017CitationUS-CERT SamSam 2018
In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers). Adversaries may need to first employ other behaviors, such as File and Directory Permissions Modification or System Shutdown/Reboot, in order to unlock and/or gain access to manipulate these files.CitationCarbonBlack Conti July 2020 In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.CitationUS-CERT NotPetya 2017 Adversaries may also encrypt virtual machines hosted on ESXi or other hypervisors.CitationCrowdstrike Hypervisor Jackpotting Pt 2 2021
To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.CitationFireEye WannaCry 2017CitationUS-CERT NotPetya 2017 Encryption malware may also leverage Internal Defacement, such as changing victim wallpapers or ESXi server login messages, or otherwise intimidate victims by sending ransom notes or other messages to connected printers (known as "print bombing").CitationNHS Digital Egregor Nov 2020CitationVaronis
In cloud environments, storage objects within compromised accounts may also be encrypted.CitationRhino S3 Ransomware Part 1 For example, in AWS environments, adversaries may leverage services such as AWS’s Server-Side Encryption with Customer Provided Keys (SSE-C) to encrypt data.CitationHalcyon AWS Ransomware 2025
Security context for executives and security teams
Data Encrypted for Impact is the core ransomware-style outcome: data, systems, virtual machines, or cloud storage objects are made unavailable by encryption. For leaders, this is not just a malware problem; it is a business continuity, recovery, and incident decision problem. The material question is whether the organization can detect rapid encryption activity early enough and restore critical services from backups that adversaries cannot also encrypt or destroy.
Executive priority
Prioritize this behavior where downtime creates material operational, financial, legal, or safety consequences. Executives should ask: which business services depend on Windows, Linux, macOS, ESXi, IaaS, and cloud storage data; whether recovery objectives have been tested; whether backups are isolated from compromised accounts; and whether SOC and IR teams have authority to contain hosts, accounts, hypervisors, and storage services quickly. The ATT&CK relationships to many ransomware campaigns and groups make this a high-value control validation area, but local exposure depends on environment, identity posture, backup architecture, and telemetry coverage.
Technical view
ATT&CK lists this as an Impact technique across ESXi, IaaS, Linux, macOS, and Windows, with no official detection text provided. SOC and detection teams should validate coverage for multi-platform file encryption behavior, aligned to the related DET0215 detection strategy, rather than relying only on malware signatures. Practical validation should include abnormal high-volume file writes, renames, extension changes, encryption markers, ransom notes or intimidation messages, access to local and remote drives, cloud object encryption activity from compromised accounts, and encryption of ESXi-hosted virtual machines. IR teams should also correlate precursor behaviors named in the ATT&CK description, including Valid Accounts, OS Credential Dumping, SMB/Windows Admin Shares, File and Directory Permissions Modification, and System Shutdown/Reboot.
Likely telemetry
- Endpoint process creation, command line, file write, file rename, and file metadata-change events on Windows, Linux, and macOS
- File share and remote drive access logs, including SMB/Windows Admin Share activity where applicable
- EDR or host telemetry showing rapid modification of many common user files such as documents, PDFs, media, text, and source code
- Filesystem indicators such as new extensions, file markers, ransom notes, wallpaper changes, or other internal defacement artifacts
- ESXi or hypervisor management logs, VM datastore access logs, and events affecting hosted virtual machines
Detection direction
- Treat detection as behavior-based because ATT&CK provides no official detection text for this object; use the DET0215 relationship as direction for multi-platform file encryption analytics.
- Tune for rate, scope, and context: high-volume encryption-like writes and renames across many directories, shares, VMs, or storage objects are more meaningful than isolated file changes.
- Correlate encryption activity with account behavior, remote administration, credential access, permission changes, and shutdown or reboot events to reduce false positives and support faster containment decisions.
- Validate cloud blind spots separately: endpoint controls may not see object storage encryption performed through cloud APIs by a compromised account.
- Validate ESXi and hypervisor blind spots separately: VM encryption or datastore manipulation may not appear in traditional workstation/server EDR telemetry.
Mitigation priorities
- Start with M1053 Data Backup: maintain hardened, isolated backups of critical end-user, server, VM, and cloud data, and test restoration against business recovery objectives.
- Protect backup systems from the same identities and networks used in normal operations so encryption activity cannot easily reach both production data and recovery copies.
- Apply M1040 Behavior Prevention on Endpoint to block or interrupt suspicious process, file, API, and endpoint behaviors associated with mass encryption rather than depending only on known signatures.
- Strengthen administrative and service account controls for systems, shares, hypervisors, and cloud storage because the ATT&CK description notes use of compromised accounts and lateral movement techniques to maximize impact.
- Ensure IR containment procedures cover endpoint isolation, account disablement, share access restriction, hypervisor administration, and cloud storage controls.
Additional notes and limits
This technique is especially useful as an executive control-validation anchor: it tests whether prevention, detection, identity controls, backup isolation, and incident command can work together under time pressure. The relationship set shows broad ATT&CK usage by ransomware campaigns, financially motivated groups, and destructive actors, but those relationships should inform prioritization and threat modeling rather than be treated as evidence of exposure in a specific environment.
The supplied ATT&CK object does not include official detection guidance, detailed procedure examples for every related actor, or environment-specific indicators. This take is limited to the official STIX fields, external references, and listed relationships. Local platform inventory, cloud architecture, backup design, IAM model, and telemetry availability are required to determine actual coverage and risk.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Data Encrypted for Impact
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.CitationUS-CERT Ransomware 2016CitationFireEye WannaCry 2017CitationUS-CERT NotPetya 2017CitationUS-CERT SamSam 2018
In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers). Adversaries may need to first employ other behaviors, such as File and Directory Permissions Modification or System Shutdown/Reboot, in order to unlock and/or gain access to manipulate these files.CitationCarbonBlack Conti July 2020 In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.CitationUS-CERT NotPetya 2017 Adversaries may also encrypt virtual machines hosted on ESXi or other hypervisors.CitationCrowdstrike Hypervisor Jackpotting Pt 2 2021
To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.CitationFireEye WannaCry 2017CitationUS-CERT NotPetya 2017 Encryption malware may also leverage Internal Defacement, such as changing victim wallpapers or ESXi server login messages, or otherwise intimidate victims by sending ransom notes or other messages to connected printers (known as "print bombing").CitationNHS Digital Egregor Nov 2020CitationVaronis
In cloud environments, storage objects within compromised accounts may also be encrypted.CitationRhino S3 Ransomware Part 1 For example, in AWS environments, adversaries may leverage services such as AWS’s Server-Side Encryption with Customer Provided Keys (SSE-C) to encrypt data.CitationHalcyon AWS Ransomware 2025
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.