Data Destruction

During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed CaddyWiper on the victim’s IT environment systems to wipe files related to the OT capabilities, along with mapped drives, and physical drive partitions.^[9]

AcidRain performs an in-depth wipe of the target filesystem and various attached storage devices through either a data overwrite or calling various IOCTLS to erase it.^[10]

APT38 has used a custom secure delete function to make deleted files unrecoverable.^[11]

BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.^[12][13]

CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files.^[14][15]

Diavol can delete specified files from a targeted system.^[16]

Gamaredon Group has used tools to delete files and folders from victims' desktops and profiles.^[17]

HermeticWiper can recursively wipe folders and files in Windows, Program Files, Program Files(x86), PerfLogs, Boot, System, Volume Information, and AppData folders using FSCTL_MOVE_FILE. HermeticWiper can also overwrite symbolic links and big files in My Documents and on the Desktop with random bytes.^[18]

Industroyer’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files.^[19]

Kazuar can overwrite files with random data before deleting them.^[20]

KillDisk deletes system files to make the OS unbootable. KillDisk also targets and deletes files with 35 different file extensions.^[21]

LAPSUS$ has deleted the target's systems and resources both on-premises and in the cloud.^[22][23]

Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.^[24]

Meteor can fill a victim's files and directories with zero-bytes in replacement of real content before deleting them.^[25]

Olympic Destroyer overwrites files locally and on remote shares.^[6][26]

PowerDuke has a command to write random data across a file and delete it.^[27]

Proxysvc can overwrite files indicated by the attacker before deleting them.^[28]

RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.^[3][5]

REvil has the capability to destroy files and folders.^{[29][30][31][31][32][33][34]}

Sandworm Team has used the BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces. ^[35][36]

SDelete deletes data in a way that makes it unrecoverable.^[37]

Shamoon attempts to overwrite operating system files and disk structures with image files.^[1][2][3] In a later variant, randomly generated data was used for data overwrites.^[5][38]

StoneDrill has a disk wiper module that targets files other than those in the Windows directory.^[4]

WhisperGate can corrupt files by overwriting the first 1 MB with 0xcc and appending random extensions.^{[39][40][41][42][43][44]}

Xbash has destroyed Linux-based databases as part of its ransomware capabilities.^[45]

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.^[46] Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.