[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1485":3},{"item":4,"lessons":18,"controls":48,"related":77},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1485","T1485","Data Destruction",7,"MITRE","**What attackers do.** Attackers destroy data and files on systems, sometimes overwriting them so they cannot be recovered, to disrupt operations. Wiper malware and destructive cloud actions fall here. This serves the Impact tactic.\n\n**How to defend.** Keep offline or immutable backups and test restores. Limit privileged access and protect administrative tools, cloud management consoles and backup systems with strong authentication. Enable deletion protection features on cloud resources where available. Use separate administrative accounts for backup and cloud management, and require approval for bulk deletion where tools allow it. Keep an incident playbook for destructive attacks, since recovery speed matters most.\n\n**Signs to look for.** Look for mass deletions, overwriting tools running, deletion of cloud resources or storage, and disabling of backups. A common gap is backup systems reachable with the same credentials attackers have already stolen.","Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as `del` and `rm` often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.\n\nAdversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable. In some cases politically oriented image files have been used to overwrite data.\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB\u002FWindows Admin Shares..","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1485\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44],{"slug":21,"title":22,"published_at":23},"ai-powered-ransomware-automates-azure-tenant-destruction","AI-Powered Ransomware Automates Azure Tenant Destruction","2026-09-28T18:20:53.034+00:00",{"slug":25,"title":26,"published_at":27},"ai-orchestrated-cloud-attacks-exploit-compromised-service-principals","AI-Orchestrated Cloud Attacks Exploit Compromised Service Principals","2026-09-25T20:20:58.463+00:00",{"slug":29,"title":30,"published_at":31},"iranian-chosen-brick-malware-targets-dissidents-via-social-engineering","Iranian CHOSEN BRICK Malware Targets Dissidents via Social Engineering","2026-09-16T22:20:38.911+00:00",{"slug":33,"title":34,"published_at":35},"gigawiper-modular-malware-enables-customizable-destructive-attacks","GigaWiper: Modular Malware Enables Customizable Destructive Attacks","2026-07-13T18:21:01.329+00:00",{"slug":37,"title":38,"published_at":39},"gigawiper-malware-combines-wiping-encryption-and-backdoor-for-devastating-sabotage","GigaWiper Malware Combines Wiping, Encryption, and Backdoor for Devastating Sabotage","2026-07-10T10:20:30.645+00:00",{"slug":41,"title":42,"published_at":43},"gigawiper-backdoor-combines-wiping-fake-ransomware-and-spyware-in-one-destructive-package","GigaWiper Backdoor Combines Wiping, Fake Ransomware, and Spyware in One Destructive Package","2026-07-09T20:20:57.739+00:00",{"slug":45,"title":46,"published_at":47},"gigawiper-modular-backdoor-merges-wiper-and-fake-ransomware-into-single-destructive-platform","GigaWiper: Modular Backdoor Merges Wiper and Fake Ransomware into Single Destructive Platform","2026-07-09T16:20:24.403+00:00",[49,54,58,63,68,72],{"slug":50,"name":51,"problem":52,"stories":53},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":55,"name":56,"problem":57,"stories":53},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":59,"name":60,"problem":61,"stories":62},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",4,{"slug":64,"name":65,"problem":66,"stories":67},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",2,{"slug":69,"name":70,"problem":71,"stories":67},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":73,"name":74,"problem":75,"stories":76},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",1,[78,83,87,92,96,100,105,109],{"family":79,"item":80,"code":81,"title":82,"together":9},"nist-800-53","ir-4","IR-4","Incident Handling",{"family":79,"item":84,"code":85,"title":86,"together":53},"si-3","SI-3","Malicious Code Protection",{"family":88,"item":89,"code":90,"title":91,"together":53},"cis","11","Control 11","Data Recovery",{"family":93,"item":94,"code":95,"title":95,"together":62},"itil","overview","ITIL",{"family":88,"item":97,"code":98,"title":99,"together":62},"13","Control 13","Network Monitoring and Defense",{"family":88,"item":101,"code":102,"title":103,"together":104},"3","Control 3","Data Protection",3,{"family":88,"item":106,"code":107,"title":108,"together":104},"17","Control 17","Incident Response Management",{"family":88,"item":110,"code":111,"title":112,"together":104},"10","Control 10","Malware Defenses"]