Data Destruction

During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed CaddyWiper on the victim’s IT environment systems to wipe files related to the OT capabilities, along with mapped drives, and physical drive partitions.^[9]

AcidRain performs an in-depth wipe of the target filesystem and various attached storage devices through either a data overwrite or calling various IOCTLS to erase it.^[10]

Apostle initially masqueraded as ransomware but actual functionality is a data destruction tool, supported by an internal name linked to an early version, wiper-action. Apostle writes random data to original files after an encrypted copy is created, along with resizing the original file to zero and changing time property metadata before finally deleting the original file.^[11]

APT38 has used a custom secure delete function to make deleted files unrecoverable.^[12]

BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.^[13][14]

CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files.^[15][16]

DEADWOOD overwrites files on victim systems with random data to effectively destroy them.^[11]

Diavol can delete specified files from a targeted system.^[17]

HermeticWiper can recursively wipe folders and files in Windows, Program Files, Program Files(x86), PerfLogs, Boot, System, Volume Information, and AppData folders using FSCTL_MOVE_FILE. HermeticWiper can also overwrite symbolic links and big files in My Documents and on the Desktop with random bytes.^[18]

Industroyer’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files.^[19]

Kazuar can overwrite files with random data before deleting them.^[20]

KillDisk deletes system files to make the OS unbootable. KillDisk also targets and deletes files with 35 different file extensions.^[21]

LAPSUS$ has deleted the target's systems and resources both on-premises and in the cloud.^[22][23]

Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.^[24]

Meteor can fill a victim's files and directories with zero-bytes in replacement of real content before deleting them.^[25]

MultiLayer Wiper deletes files on network drives, but corrupts and overwrites with random data files stored locally.^[26]

Olympic Destroyer overwrites files locally and on remote shares.^[6][27]

PowerDuke has a command to write random data across a file and delete it.^[28]

Proxysvc can overwrite files indicated by the attacker before deleting them.^[29]

RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.^[3][5]

REvil has the capability to destroy files and folders.^{[30][31][32][32][33][34][35]}

Sandworm Team has used CaddyWiper, SDelete, and the BlackEnergy KillDisk component to overwrite files on victim systems. ^[36][37][9] Additionally, Sandworm Team has used the JUNKMAIL tool to overwrite files with null bytes.^[38]

SDelete deletes data in a way that makes it unrecoverable.^[39]

Shamoon attempts to overwrite operating system files and disk structures with image files.^[1][2][3] In a later variant, randomly generated data was used for data overwrites.^[5][40]

StoneDrill has a disk wiper module that targets files other than those in the Windows directory.^[4]

WhisperGate can corrupt files by overwriting the first 1 MB with 0xcc and appending random extensions.^{[41][42][43][44][45][46]}

Xbash has destroyed Linux-based databases as part of its ransomware capabilities.^[47]

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.^[48] Ensure backups are stored off system and protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.

Implement multi-factor authentication (MFA) delete for cloud storage resources, such as AWS S3 buckets, to prevent unauthorized deletion of critical data and infrastructure. MFA delete requires additional authentication steps, making it significantly more difficult for adversaries to destroy data without proper credentials. This additional security layer helps protect against the impact of data destruction in cloud environments by ensuring that only authenticated actions can irreversibly delete storage or machine images.

In cloud environments, limit permissions to modify cloud bucket lifecycle policies (e.g., PutLifecycleConfiguration in AWS) to only those accounts that require it. In AWS environments, consider using Service Control policies to limit the use of the PutBucketLifecycle API call.