Data Destruction
Technique · ATTACK:enterprise:T1485
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1485",
"title": "Data Destruction",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1485",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c",
"external_id": "T1485",
"domain": "enterprise",
"created": "2019-03-14T18:47:17.701Z",
"modified": "2026-05-12T15:12:00.717Z",
"version": "1.4",
"aliases": [
],
"tactics": [
"impact"
],
"source_references": [
{
"source_name": "DOJ - Cisco Insider",
"url": "https://www.justice.gov/usao-ndca/pr/san-jose-man-pleads-guilty-damaging-cisco-s-network"
},
{
"source_name": "Unit 42 Shamoon3 2018",
"url": "https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"
},
{
"source_name": "Palo Alto Shamoon Nov 2016",
"url": "http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"
},
{
"source_name": "FireEye Shamoon Nov 2016",
"url": "https://web.archive.org/web/20210126065851/https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html"
},
{
"source_name": "Kaspersky StoneDrill 2017",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"
},
{
"source_name": "Talos Olympic Destroyer 2018",
"url": "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
},
{
"source_name": "Data Destruction - Threat Post",
"url": "https://threatpost.com/hacker-puts-hosting-service-code-spaces-out-of-business/106761/"
},
{
"source_name": "Symantec Shamoon 2012",
"url": "https://www.symantec.com/connect/blogs/shamoon-attacks"
}
]
}Explicit source assertions (44)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--063b76d3-a002-44a1-aafa-d626008ee786
Fortinet Diavol July 2021ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13576b41-ec77-418c-b581-d3fa461df941
Cisco Ukraine Wipers January 2022 · Crowdstrike WhisperGate January 2022 · Cybereason WhisperGate February 2022 · Unit 42 WhisperGate January 2022 · Microsoft WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16873550-3105-4ce5-92fc-7b8127e47b5d
Dragos Crashoverride 2017ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b996e11-03b7-48fc-9ce2-cd08fdf0d07d
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c8208ad-b295-4e39-a928-40fc49f68fb4
Unit42 Xbash Sept 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27323a25-ef80-4519-b934-19f5ff090c70
Novetta BlockbusterATTACK:enterprise:S1125 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28d36206-062f-42be-93a1-f9cf2910c3c4
AcidRain JAGS 2022ATTACK:enterprise:T1485.001 → subtechnique-of → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2cf95c9b-01d0-4300-b635-be63399da755
ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3184811d-4b00-4fdd-aa4b-5c16eb3294ed
Palo Alto Unit 42 Shai-Hulud November 2025 · Microsoft Shai-Hulud December 2025 · Socket Shai-Hulud November 2025ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31bf8ae4-e757-462c-aa30-c4a9dd92c677
Kaspersky Sodin July 2019 · Secureworks GandCrab and REvil September 2019 · McAfee Sodinokibi October 2019 · McAfee Sodinokibi October 2019 · Intel 471 REvil March 2020 · Picus Sodinokibi January 2020 · Secureworks REvil September 2019ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--333bd465-8713-4918-b60d-6128c52cbf04
Unit 42 Kazuar May 2017ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38938866-d940-4223-b811-e3b8420f6408
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:S9038 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e18cf3c-e185-4f9f-a413-7cfc89f28b48
CERT Polska · ESET DynoWiper Update JAN 2026ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40ad3b2e-e88c-43a2-82c5-666e8ae568e4
ESET Hermetic Wizard March 2022ATTACK:enterprise:S9030 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46592001-5c4e-4b12-9fb7-d63e8f8c075d
Check Point Wirte NOV 2024ATTACK:enterprise:S1134 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--479ec00e-ce63-4a2f-8489-e0df55238e88
SentinelOne Agrius 2021ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b4ac061-dee5-44f3-b0f5-021889eae45e
Unit 42 Shamoon3 2018 · Palo Alto Shamoon Nov 2016 · FireEye Shamoon Nov 2016 · McAfee Shamoon December 2018 · Symantec Shamoon 2012ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5135ba35-04b7-4cfc-bc6c-03f63206e757
Volexity PowerDuke November 2016ATTACK:enterprise:C0034 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70378c31-da06-4ec0-a8c6-b578dfeafb41
Mandiant-Sandworm-Ukraine-2022ATTACK:enterprise:S0365 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7767d727-fba8-4b7a-b7fe-137ed9261680
Talos Olympic Destroyer 2018 · US District Court Indictment GRU Unit 74455 October 2020ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77cd972c-459f-4cac-ae21-3cc1a96df09e
FireEye APT38 Oct 2018ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e54d357-1cc6-45cf-8fb5-e85d20cc436c
Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S1135 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b0efe89-4888-4c10-8a91-2ed78038a7cb
Unit42 Agrius 2023ATTACK:enterprise:S0693 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a65cc371-4fa4-48e9-b95d-22ac81d67085
ESET CaddyWiper March 2022 · Cisco CaddyWiper March 2022ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad410271-db42-45b4-a5a5-6133bba495ce
ATTACK:enterprise:M1053 → mitigates → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af1e6f67-b513-42f7-b5df-dfb04b38caf6
Ready.gov IT DRPATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6baac4e-00ab-41e6-a035-d2f7d511e476
ATTACK:enterprise:S9039 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c576e2b9-dc3f-4c4a-8465-41e92a93c90a
CERT PolskaATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6986534-9705-42f2-baa7-66e760090e8a
ESET DynoWiper Update JAN 2026 · ESET DynoWiper JAN 2026ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cbca9348-6e7b-49bd-88f5-66b0ec02e5d0
Flashpoint Mini Shai-Hulud MAY 2026 · Hunt.io TeamPCP Toolkit MAY 2026 · Phoenix TeamPCP 20 MAY 2026ATTACK:enterprise:S0195 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfb4c18a-d76e-47fd-a89b-a4b4fce1c643
Microsoft SDelete July 2016ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5166d3e-246b-473c-9ff0-c5cc97dd91de
Securelist BlackEnergy Feb 2015 · ESET BlackEnergy Jan 2016ATTACK:enterprise:S0364 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7d25f15-7451-4092-acb5-1a22095bc3cd
Palo Alto Shamoon Nov 2016 · Unit 42 Shamoon3 2018ATTACK:enterprise:S0688 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0cbaae4-9a39-4da4-a0a2-8c60dfa8e0c8
Check Point Meteor Aug 2021ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e45c0080-ee1c-4ef1-813f-d58b83de4a8b
ESEST Black Energy Jan 2016ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e723abac-5d58-4370-9f6e-4db8fb9697cb
Splunk ShrinkLocker 2024ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e85a5fe7-cbfe-44b1-b297-d02f531c5fb1
ESET Telebots June 2017 · Mandiant-Sandworm-Ukraine-2022 · mandiant_apt44_unearthing_sandworm · US-CERT Ukraine Feb 2016ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec2d8154-cb3b-4d65-82ba-4e6c81697306
Check Point VOID MANTICORE Handala Hack March 2026 · SPECOPS Outpost24 Handala Hack Stryker March 2026 · DOJ FBI Handala Hack March 2026 · Palo Alto VOID MANTICORE Iran Cyber Threats March 2026ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee5c102e-b129-4fc2-a785-5c98cf7436e1
Aikido CanisterWorm MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S0238 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0c53ce3-a265-4da9-a553-c5f2faffa5b8
McAfee GhostSecretATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f105ba9c-5c64-4728-9f97-aa3b6d8ed274
Unit42KelleyVaya_BlingLibra_Aug2024ATTACK:enterprise:S1133 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f24943ee-409c-45eb-8277-7a7dc197eddd
SentinelOne Agrius 2021ATTACK:enterprise:S1167 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f907268d-bcc8-4a55-81d6-0ad35a765879
SentinelOne AcidPour 2024ATTACK:enterprise:S0380 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe2aa2b2-6508-40e1-b0cf-13c66ae43064
Kaspersky StoneDrill 2017