Internal Defacement
Subtechnique · ATTACK:enterprise:T1491.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1491.001",
"title": "Internal Defacement",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1491/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--8c41090b-aa47-4331-986b-8c9a51a91103",
"external_id": "T1491.001",
"domain": "enterprise",
"created": "2020-02-20T14:31:34.778Z",
"modified": "2026-05-12T15:12:00.705Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"impact"
],
"source_references": [
{
"source_name": "Varonis",
"url": "https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire"
},
{
"source_name": "Novetta Blockbuster Destructive Malware",
"url": "https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"
},
{
"source_name": "Novetta Blockbuster",
"url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
}
]
}Explicit source assertions (18)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04b9d1e7-6deb-46f8-9fe3-9fb870ba8d72
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09677a24-20ac-4983-a97f-f1b54282b609
CERT-EE Gamaredon January 2021ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c7a59a3-fce4-4ffc-bbf2-3e3f110d7dea
Kaspersky ShrinkLocker 2024 · Splunk ShrinkLocker 2024ATTACK:enterprise:T1491.001 → subtechnique-of → ATTACK:enterprise:T1491
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19ed775b-d3cb-48ec-916a-c26e7539ccc6
ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--314719c9-a946-4630-a09c-d416b48f4c21
Avertium Black Basta June 2022 · BlackBerry Black Basta May 2022 · Check Point Black Basta October 2022 · Cyble Black Basta May 2022 · Palo Alto Networks Black Basta August 2022 · Trend Micro Black Basta May 2022 · NCC Group Black Basta June 2022 · Deep Instinct Black Basta August 2022 · Minerva Labs Black Basta May 2022ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5410e6d1-1ec5-4cb9-9647-378f2266f774
Fortinet Diavol July 2021ATTACK:enterprise:S9030 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cb87b1f-e909-49be-b508-0d315090a152
Check Point Wirte NOV 2024ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a02ffe3-2c0d-4d47-a10f-892797c568ea
FBI BlackByte 2022ATTACK:enterprise:S1150 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c2f9c04-540f-4ea9-be8a-95ca1d6866cd
Microsoft Albanian Government Attacks September 2022ATTACK:enterprise:M1053 → mitigates → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77d97059-4280-41d0-8280-596a6e2b8ff8
Ready.gov IT DRPATTACK:enterprise:S0688 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78c0b480-23c1-4de7-867e-d4e9ef4c8df6
Check Point Meteor Aug 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79904c38-8fb6-45e3-98f7-98856e08421f
Novetta Blockbuster Destructive MalwareATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b48e1b5-e52b-44a2-9a8e-6e21126c3705
Google_SHOracle_Jun2026ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa990715-4a91-4eab-a1b6-ba8e013c5223
CISA RansomHub AUG 2024ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aaa5dc30-1195-4edd-881e-63934b9f8c4d
CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bec3259a-58d3-44a5-95c7-c8eb16427e85
Sophos BlackCat Jul 2022 · Microsoft BlackCat Jun 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f889a92b-6071-4b34-b799-782dff1798d1
Sophos Qilin MSP APR 2025 · Cisco Talos Qilin Ransomware OCT 2025 · Trend Micro Agenda Ransomware OCT 2025ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ffe4e161-2ebc-41da-b6e6-227cc6ead76c
Secureworks GOLD IONIC April 2024 · Cybereason INC Ransomware November 2023