Disk Content Wipe
Subtechnique · ATTACK:enterprise:T1561.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1561.001",
"title": "Disk Content Wipe",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1561/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--fb640c43-aa6b-431e-a961-a279010424ac",
"external_id": "T1561.001",
"domain": "enterprise",
"created": "2020-02-20T22:06:41.739Z",
"modified": "2026-05-12T15:12:00.726Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"impact"
],
"source_references": [
{
"source_name": "DOJ Lazarus Sony 2018",
"url": "https://www.justice.gov/opa/press-release/file/1092091/download"
},
{
"source_name": "Novetta Blockbuster Destructive Malware",
"url": "https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"
},
{
"source_name": "Novetta Blockbuster",
"url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
},
{
"source_name": "Microsoft Sysmon v6 May 2017",
"url": "https://docs.microsoft.com/sysinternals/downloads/sysmon"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b904ffe-e310-453c-be4d-c647b0e3a1f4
SPECOPS Outpost24 Handala Hack Stryker March 2026 · DOJ FBI Handala Hack March 2026ATTACK:enterprise:S1205 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d5f23ec-c707-4c22-b467-e1776240a923
Nearest Neighbor VolexityATTACK:enterprise:S1134 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11f7aee6-3479-4756-8300-741e28e75142
SentinelOne Agrius 2021ATTACK:enterprise:S1125 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cfbd739-de51-4a86-b116-8a8fc09c387f
AcidRain JAGS 2022ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--774a6b5c-bbba-4094-bac3-0fa5e664bf2a
Cisco Ukraine Wipers January 2022 · Crowdstrike WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78ca7fcf-95b9-485c-a87b-2ac083312885
Novetta Blockbuster Destructive MalwareATTACK:enterprise:S0364 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7fa1a7c8-0dfb-4bd5-a34f-509ba24da5be
Novetta Blockbuster Destructive MalwareATTACK:enterprise:S0576 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8550e43c-ca91-416e-a75a-b6f5f979d457
IBM MegaCortexATTACK:enterprise:M1053 → mitigates → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8fbcd0f5-4fd4-482b-b965-9b4232e4ee64
Ready.gov IT DRPATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2e09ef2-2511-476b-8759-264843b4d772
CERT-EE Gamaredon January 2021ATTACK:enterprise:T1561.001 → subtechnique-of → ATTACK:enterprise:T1561
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6e77d6e-a76d-446c-a8ac-03b48892b7cb
ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af3fa17b-e789-4522-af82-663a6d7bcaa3
CheckPointResearch_TheGentlemen_April2026ATTACK:enterprise:C0051 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2fc39b7-17b5-4ca3-914a-7a5d03146c29
Nearest Neighbor VolexityATTACK:enterprise:S1167 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc2e4eb6-8fd6-45bb-94d8-765fafaeee3d
SentinelOne AcidPour 2024ATTACK:enterprise:S1133 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cef64d3f-3747-4811-8104-09f63a24b32b
SentinelOne Agrius 2021ATTACK:enterprise:S1010 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1f69900-05e0-4e20-be0d-4311e50a820f
VPNFilter RouterATTACK:enterprise:S0380 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2041a67-d846-4a1b-b704-4e437baa731a
Symantec Elfin Mar 2019ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d687171f-152f-4211-95bb-e051dc61575f
SentinelOne Hermetic Wiper February 2022 · Crowdstrike DriveSlayer February 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9af5e2e-3ac5-451a-bc63-c3e26ca6371e
Sophos BlackCat Jul 2022 · Microsoft BlackCat Jun 2022ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eefb1822-dbcc-4919-8c76-f5ca0c371bf0
Rapid7 BlackBasta 2024