Data Destruction (T1485): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1485.
- Tactical Phase: Impact.
- Substantiated in 10 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (10)
U.S. v. Andrienko et al. (Sandworm / GRU Unit 74455)
Six Russian Main Intelligence Directorate (GRU) military officers charged with deploying the NotPetya wiper, Olympic Destroyer malware, KillDisk attacks against Ukrainian power grids, and cyberattacks targeting French elections.
"The conspirators deployed the NotPetya malware, designed to irreversibly encrypt and destroy victim computer records worldwide while masquerading as ransomware."
U.S. v. Park Jin Hyok (Lazarus Group / Chosun Expo)
Department of Justice charges North Korean state-sponsored programmer with the 2014 Sony Pictures hack, the 2017 global WannaCry ransomware outbreak, and the $81 million Bangladesh Bank cyber heist.
"The Sony Pictures attack used the Destover wiper to destroy master boot records and overwrite hard drives, rendering thousands of workstations permanently inoperable."
U.S. v. IRGC Actors (CyberAv3ngers Critical Infrastructure Attacks)
Indictment of members of the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command who compromised Israeli-made Unitronics programmable logic controllers (PLCs) at American municipal water facilities.
"Attackers defaced screen displays on industrial pressure monitoring stations with anti-Israel political slogans and halted remote pump regulation."
Operation Olympic Games (Stuxnet Industrial SCADA Cyberweapon)
Joint United States and Israeli covert cyber operation that deployed the Stuxnet computer worm, the first known malware capable of causing physical destruction to industrial hardware. The worm exploited four Windows zero-day vulnerabilities and compromised Siemens Step7 PLC software to spin Natanz nuclear centrifuges out of control.
"The worm intercepted Siemens Step7 communications with programmable logic controllers (PLCs), secretly overriding centrifuge rotational frequencies while transmitting recorded normal telemetry back to control room displays."
Saudi Aramco Shamoon Wiper Attack (Cutting Sword of Justice)
Devastating state-sponsored wiper attack attributed to Iranian threat actors ('Cutting Sword of Justice') that detonated the Shamoon (Disttrack) wiper across Saudi Aramco, simultaneously wiping 35,000 workstation hard drives and overwriting Master Boot Records with an image of a burning American flag.
"The Wiper module contained an embedded EldoS RawDisk driver to bypass Windows operating system write protection, directly overwriting raw sector bytes of the Master Boot Record with image data."
AT&T Cloud Telecom Call and Text Metadata Exfiltration
Illegal exfiltration of call and text interaction metadata spanning six months for approximately 110 million AT&T wireless customers. Intrusion stemmed from an illicit access point to a third-party Snowflake cloud environment, leading to a 5.7 Bitcoin extortion fee paid through an intermediary to obtain verified video evidence of dataset deletion.
Adversaries demanded cryptocurrency extortion to prevent public dissemination, providing video screen recording evidence of database deletion upon receiving 5.7 Bitcoin.
Sony Pictures Entertainment Destructive Wiper Attack
North Korean state-sponsored operators infiltrated Sony Pictures Entertainment, deploying destructive Shamoon/Destover wipers that permanently erased thousands of servers and workstations, exfiltrating terabytes of unreleased films, employee SSNs, and executive emails.
"The Destover wiper module executed raw disk write calls to overwrite the Master Boot Record and partition tables, followed by automated reboots that rendered operating systems unbootable."
Ukraine Electrical Substation Cyber Warfare Blackout
First confirmed cyberattack to deliberately cause an electrical power grid blackout. Russian military GRU hackers infiltrated power distribution companies, hijacked SCADA human-machine interfaces (HMI), opened circuit breakers at 30 substations, and destroyed control systems with KillDisk.
"Operators deployed the KillDisk wiper utility, overwriting master boot records and systematically destroying operator workstation files to inhibit grid restoration."
Viasat KA-SAT Satellite Modem Wiper Sabotage (AcidRain)
Russian state-sponsored operators exploited an unpatched Fortinet VPN gateway to access Viasat satellite network management segments, broadcasting malicious AcidRain wiper firmware that permanently bricked tens of thousands of satellite terminals across Ukraine and Europe.
"The AcidRain malware iterated across flash memory partitions (/dev/mtd*), overwriting them with recursive byte patterns and resetting modems into an unbootable bricked state."
U.S. v. Amin Stigal (GRU Unit 29155 WhisperGate Wiper)
Federal criminal indictment charging Russian military intelligence conspirator serving GRU Unit 29155 with unleashing the destructive WhisperGate master boot record wiper malware against Ukrainian civilian ministry systems on the eve of the 2022 invasion and conducting cyber reconnaissance against 26 NATO member state critical infrastructure networks.
"WhisperGate executed a multi-component wiper that overwrote the Master Boot Record with a fraudulent ransom note while deploying a secondary payload to destroy user files with zero bytes."
Commonly Charged Criminal Statutes
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
Extortion in Connection with Computers
Prohibits transmitting in interstate or foreign commerce threats to cause damage to a protected computer or obtain confidential information with intent to extort money or value.
Conspiracy to Commit Computer Fraud
Punishes any person who conspires to commit or attempts to commit any computer fraud offense under section 1030.
Money Laundering
Prohibits conducting financial transactions knowing that the property involved represents the proceeds of unlawful activity to promote unlawful activity or conceal the nature or ownership of the proceeds.