ATT&CK Wipers and Destructive Malware Software Hub: Spotting Destruction Before Data Is Lost

A wiper gives no ransom, no negotiation window and no decryptor, so the only defence that counts is the one that acts before the overwrite finishes. This hub collects the 18 ATT&CK Enterprise v20 software entries NHI Mgmt Group files under wipers and destructive malware, from Shamoon and Olympic Destroyer to HermeticWiper, the Agrius wiper set, the 2025 Poland Wiper Attacks tools and the TeamPCP supply chain worms with destructive components. It shows the behaviours they share, how to detect them across families and platforms, and how identity controls limit what a destructive operator can reach. It is for detection engineers, threat intelligence analysts and resilience leads. For the general wiper programme, see the Wiper Malware Guide; for response, the Wiper Attack Response Playbook. This page stays on the ATT&CK software view.

Key takeaways

• Data Destruction is the common thread. 14 of the 18 entries map to T1485 Data Destruction, 8 to T1561.002 Disk Structure Wipe and 5 to T1561.001 Disk Content Wipe in ATT&CK v20.
• Destruction usually ends with a reboot. 8 entries map to T1529 System Shutdown/Reboot, which is what turns a corrupted boot record or partition table into an unbootable machine.
• Many wipers pose as something else. ATT&CK describes WhisperGate as a wiper designed to look like ransomware, and Microsoft found its ransom note offered no recovery path. Treat every "ransomware" with no working payment process as a possible wiper.
• Destruction is no longer Windows only. AcidPour targets x86 Linux devices including networking and embedded types, VPNFilter targets network devices, and CanisterWorm and Mini Shai-Hulud reach containers and developer pipelines.
• Admin tools can be the wiper. In the Stryker incident, the attacker used Microsoft Intune's own wipe command rather than malware, so privileged management identities belong in the same threat model as this catalogue.

What this hub covers and how it was built

ATT&CK catalogues software as malware or tools and links each entry to the techniques it uses and the groups and campaigns that used it. It does not group software into categories, so NHI Mgmt Group assigned each v20 Enterprise entry to one hub by primary role. This hub holds the 18 entries whose main purpose is destruction. Destructive families that present mainly as ransomware and map to T1486, such as NotPetya and KillDisk, are in the ATT&CK Ransomware Software Hub. All counts here were computed from active (non-revoked, non-deprecated) v20 relationships and are a snapshot of that release.

Common behaviours across the catalogue

The pattern is short and loud: discovery of files, disks and time, then overwrite, then reboot. Shamoon is documented by ATT&CK using the RawDisk driver, and ZeroCleare uses RawDisk too, which is why kernel driver loading on servers is a key signal. See the MITRE ATT&CK T1561 Disk Wipe and MITRE ATT&CK T1485 Data Destruction.

Detection themes that work across families

• Raw disk access: processes opening physical drives or volumes for write (\\.\PhysicalDrive0 style handles) and new kernel drivers loading on servers, especially signed third party disk drivers that are not in your baseline.
• Boot record and partition changes: writes to the MBR or GPT and boot configuration, followed by a scheduled or forced reboot. Microsoft recommended Controlled Folder Access in Defender for Endpoint to block MBR and VBR modification after WhisperGate.
• Uniform overwrite patterns: many files rewritten to the same size or filled with a repeated byte. Microsoft found WhisperGate's corrupter overwrote target files with 0xCC bytes to a 1 MB length and gave them a random four-byte extension.
• Mass scheduled tasks and Group Policy changes (T1053.005, T1484.001): the same task or policy created across many hosts in minutes, timed for a single detonation. See the T1053 Scheduled Task/Job Defensive Guide.
• Log and tool tampering (T1685): event log clearing and EDR stops in the minutes before destruction.
• Bulk management actions: many device wipe, retire or delete commands from a device management console, or a new global administrator followed by bulk actions. These need no malware at all.
• Linux and device signals: writes to block devices, flash or UBI volumes from unexpected processes, and firmware or boot partition changes on appliances. See the ATT&CK Network Device Malware Software Hub.
• Pipeline signals: install scripts that download runtimes and run obfuscated code in CI, and new public repositories created under developer accounts. See the Shai-Hulud npm Worm Guide.

Prevention and hardening themes

ATT&CK v20 maps M1053 Data Backup as the only mitigation for T1561 Disk Wipe, and M1053, M1032 Multi-factor Authentication and M1018 User Account Management for T1485. The practical order is:

1. Make recovery independent of the domain. Offline or immutable backups, golden images and rebuild runbooks that do not depend on the identity plane the attacker holds. The NCSC warns that some apparent ransomware is a wiper that cannot decrypt files.
2. Control kernel drivers. Enable a vulnerable driver blocklist and application control for drivers on servers, and alert on any new driver service.
3. Protect boot integrity. Use UEFI Secure Boot and Controlled Folder Access, and keep recovery media and bare metal restore tested.
4. Require approval for bulk destructive actions. Use multi-administrator approval for device wipes and mass deletes in endpoint management and cloud consoles where the platform offers it.
5. Segment OT and energy assets. Several clusters targeted energy and power. See the MITRE ATT&CK for ICS Guide.
6. Harden pipelines. Disable install scripts in CI where possible and keep publishing tokens away from untrusted builds.

Where identity fits

• Management consoles: the Stryker attacker compromised an existing administrator account, created a new Global Administrator and used Intune to wipe devices. The Iran-linked persona Handala claimed it; the US Justice Department says Handala is operated by Iran's Ministry of Intelligence and Security. See the Stryker Cyberattack 2026 page and the Handala and Void Manticore Threat Actor Profile Guide.
• Domain administration: Group Policy and remote service creation deploy wipers to every host at once, so Domain Admin and GPO edit rights need just-in-time elevation and alerting.
• Registry and CI tokens: ATT&CK maps CanisterWorm and Mini Shai-Hulud to T1528 Steal Application Access Token and T1552.004 Private Keys; stolen npm and GitHub tokens let them spread. See the Mini Shai-Hulud 2026 page and the TeamPCP Threat Actor Profile Guide.
• Remote access accounts: after WhisperGate, Microsoft advised reviewing remote access authentication, especially single-factor accounts, and enforcing MFA on all remote connections.

Common failure patterns

• Treating a wiper as ransomware: spending days on negotiation while the attacker never intended to decrypt.
• Backups inside the blast radius: backup servers joined to the domain and wiped by the same Group Policy push.
• No raw disk telemetry: EDR policies that log file activity but not physical drive handles or driver loads.
• Unchecked admin consoles: standing Global Administrator rights and no second approval for bulk wipes, as the Stryker incident showed.
• Ignoring appliances: routers, modems and Linux devices with no integrity monitoring, the targets of VPNFilter and AcidPour.

Framework mapping

Catalogue: all 18 wiper and destructive hub entries

Every entry is ATT&CK software type malware. Groups and campaigns come from v20 "uses" relationships; where a live NHI Mgmt Group actor profile exists, the group links to it. "Signature techniques" lists up to four destructive or enabling techniques the entry maps to, in priority order (T1485, T1561, T1486, T1529 and so on), and "Techniques mapped" is the total in v20. Entries are listed alphabetically.

For the actors behind several of these families, see the Sandworm Threat Actor Profile, Agrius Threat Actor Profile Guide, APT33 Threat Actor Profile Guide and Cadet Blizzard Threat Actor Profile Guide (Microsoft renamed DEV-0586, the actor behind WhisperGate, to Cadet Blizzard in June 2023). Credential stealers are in the ATT&CK Infostealers Software Hub.

Practitioner checklist

• Alert on raw physical drive writes, MBR and GPT changes, and new kernel driver services on servers.
• Correlate mass scheduled task or Group Policy creation with log clearing and EDR stops.
• Keep backups and rebuild tooling outside the production identity plane, and rehearse a full rebuild.
• Require a second administrator for bulk device wipes and mass deletes in management consoles.
• Alert on new Global Administrator or equivalent role assignments in real time.
• Monitor appliances and Linux devices for firmware and block device changes.
• Treat ransomware with no viable payment path as a possible wiper and move to recovery early.

Standards and references

• MITRE ATT&CK: Software
• MITRE ATT&CK: T1485 Data Destruction
• MITRE ATT&CK: T1561 Disk Wipe
• Microsoft Threat Intelligence: Destructive malware targeting Ukrainian organizations
• NCSC: Mitigating malware and ransomware attacks
• CISA, MS-ISAC, NSA and FBI: #StopRansomware Guide
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Wiper Malware Guide, Wiper Attack Response Playbook, ATT&CK Impact Tactic Guide, MITRE ATT&CK T1529 System Shutdown/Reboot.