Indicator Removal (T1070): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1070.
- Tactical Phase: Defense Evasion.
- Substantiated in 2 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (2)
U.S. v. Joshua Schulte (CIA Vault 7 Leak)
Former Central Intelligence Agency software developer convicted of the historic transmission of classified CIA cyber warfare tools, source code, and zero-day exploits (Vault 7) to WikiLeaks, causing catastrophic national security damage.
"Defendant deleted server log files and altered system configuration timestamps to conceal his exfiltration of the CIA development branch."
U.S. v. Wu et al. (Equifax PLA Unit 54th Research Institute)
Four military officers with the Chinese People's Liberation Army (PLA) 54th Research Institute charged with hacking into Equifax networks, stealing trade secrets, and exfiltrating personally identifiable information (PII) of roughly 147 million American citizens.
"Defendants routinely deleted temporary files and log entries, routed communications through encrypted tunnels, and ran roughly 9,000 queries to mask their database reconnaissance."
Commonly Charged Criminal Statutes
Aggravated Identity Theft
Mandates a consecutive two-year prison sentence for knowingly transferring, possessing, or using without lawful authority a means of identification of another person during felony computer fraud or wire fraud.
Conspiracy to Commit Offense or Defraud the United States
Prohibits two or more persons conspiring to commit any federal offense or to defraud the United States in any manner or for any purpose.