Data Destruction

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.[1][2][3][4][5][6] Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.[4][5] In some cases politically oriented image files have been used to overwrite data.[2][3][4]

To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.[1][2][3][4][6].

In cloud environments, adversaries may leverage access to delete cloud storage, cloud storage accounts, machine images, and other infrastructure crucial to operations to damage an organization or their customers.[7][8]

ID: T1485
Sub-techniques:  No sub-techniques
Tactic: Impact
Platforms: IaaS, Linux, Windows, macOS
Permissions Required: Administrator, SYSTEM, User, root
Data Sources: Cloud Storage: Cloud Storage Deletion, Command: Command Execution, File: File Deletion, File: File Modification, Image: Image Deletion, Instance: Instance Deletion, Process: Process Creation, Snapshot: Snapshot Deletion, Volume: Volume Deletion
Impact Type: Availability
Contributors: Brent Murphy, Elastic; David French, Elastic; Prasad Somasamudram, McAfee; Sekhar Sarukkai, McAfee ; Syed Ummar Farooqh, McAfee; Varonis Threat Labs
Version: 1.1
Created: 14 March 2019
Last Modified: 25 March 2021

Procedure Examples

ID Name Description
G0082 APT38

APT38 has used a custom secure delete function to make deleted files unrecoverable.[9]

S0089 BlackEnergy

BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.[10][11]

S0265 Kazuar

Kazuar can overwrite files with random data before deleting them.[12]

G0032 Lazarus Group

Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.[13]

S0365 Olympic Destroyer

Olympic Destroyer overwrites files locally and on remote shares.[6][14]

S0139 PowerDuke

PowerDuke has a command to write random data across a file and delete it.[15]

S0238 Proxysvc

Proxysvc can overwrite files indicated by the attacker before deleting them.[16]

S0364 RawDisk

RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.[3][5]

S0496 REvil

REvil has the capability to destroy files and folders.[17][18][19][19][20][21][22]

G0034 Sandworm Team

Sandworm Team has used the BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces. [23][24]

S0195 SDelete

SDelete deletes data in a way that makes it unrecoverable.[25]

S0140 Shamoon

Shamoon attempts to overwrite operating system files and disk structures with image files.[1][2][3] In a later variant, randomly generated data was used for data overwrites.[5][26]

S0380 StoneDrill

StoneDrill has a disk wiper module that targets files other than those in the Windows directory.[4]

S0341 Xbash

Xbash has destroyed Linux-based databases as part of its ransomware capabilities.[27]

Mitigations

ID Mitigation Description
M1053 Data Backup

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.[28] Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.

Detection

Use process monitoring to monitor the execution and command-line parameters of binaries that could be involved in data destruction activity, such as SDelete. Monitor for the creation of suspicious files as well as high unusual file modification activity. In particular, look for large quantities of file modifications in user directories and under C:\Windows\System32\.

In cloud environments, the occurrence of anomalous high-volume deletion events, such as the DeleteDBCluster and DeleteGlobalCluster events in AWS, or a high quantity of data deletion events, such as DeleteBucket, within a short period of time may indicate suspicious activity.

References

  1. Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019.
  2. FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved January 11, 2017.
  3. Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.
  4. Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.
  5. Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.
  6. Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.
  7. Mimoso, M.. (2014, June 18). Hacker Puts Hosting Service Code Spaces Out of Business. Retrieved December 15, 2020.
  8. DOJ. (2020, August 26). San Jose Man Pleads Guilty To Damaging Cisco’s Network. Retrieved December 15, 2020.
  9. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018.
  10. Baumgartner, K. and Garnaeva, M.. (2015, February 17). BE2 extraordinary plugins, Siemens targeting, dev fails. Retrieved March 24, 2016.
  11. Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry . Retrieved June 10, 2020.
  12. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  13. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  14. Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.
  1. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
  2. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  3. Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.
  4. Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.
  5. McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.
  6. Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.
  7. Ozarslan, S. (2020, January 15). A Brief History of Sodinokibi. Retrieved August 5, 2020.
  8. Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.
  9. US-CERT. (2016, February 25). ICS Alert (IR-ALERT-H-16-056-01) Cyber-Attack Against Ukrainian Critical Infrastructure. Retrieved June 10, 2020.
  10. Cherepanov, A.. (2017, June 30). TeleBots are back: Supply chain attacks against Ukraine. Retrieved June 11, 2020.
  11. Russinovich, M. (2016, July 4). SDelete v2.0. Retrieved February 8, 2018.
  12. Mundo, A., Roccia, T., Saavedra-Morales, J., Beek, C.. (2018, December 14). Shamoon Returns to Wipe Systems in Middle East, Europe . Retrieved May 29, 2020.
  13. Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.
  14. Ready.gov. (n.d.). IT Disaster Recovery Plan. Retrieved March 15, 2019.