Disk Content Wipe (T1561.001)
Disk Structure Wipe [T1561.001]
Last updated
Disk Structure Wipe [T1561.001]
Last updated
Name: Disk Content Wipe
ID: T1561.001
Tactics:
Technique:
Disk Structure Wipe (T1561.001) is a sub-technique within the MITRE ATT&CK framework categorized under Impact (T1561). This technique involves adversaries intentionally corrupting or destroying disk structures, such as Master Boot Records (MBR), partition tables, or file system metadata, to disrupt system functionality or render devices inoperable. Attackers typically utilize this sub-technique to cause significant downtime, data loss, or permanent damage to targeted systems, often as part of sabotage, ransomware attacks, or destructive cyber operations.
Disk Structure Wipe specifically targets critical disk structures necessary for the operating system (OS) to access and manage stored data. Attackers achieve this by overwriting, corrupting, or deleting:
Master Boot Record (MBR):
Located in the first sector of a storage device; contains bootloader and partition information.
Attackers overwrite or corrupt MBR to prevent OS booting, causing immediate downtime.
Typically achieved using tools or custom malware that directly writes to disk sectors, bypassing OS-level protections.
GUID Partition Table (GPT):
Modern partitioning scheme used in newer systems.
Attackers overwrite GPT headers or partition entries to render partitions inaccessible or unbootable.
File Allocation Table (FAT) or Master File Table (MFT):
Structures used by file systems (FAT, NTFS) to track file locations and metadata.
Attackers corrupt or delete these tables, resulting in data loss or inaccessibility.
Technical methods attackers commonly use:
Direct disk writes using system calls or low-level APIs.
Kernel-mode drivers or rootkits to bypass OS protections.
Bootkits or firmware-level malware to persistently corrupt disk structures.
Custom malware payloads embedded within ransomware or wiper malware.
Attackers may leverage legitimate tools or utilities, such as:
Diskpart (Windows command-line disk management utility)
DD (Unix/Linux disk manipulation tool)
Third-party disk wiping utilities or custom scripts.
Disk Structure Wipe is typically employed in scenarios where adversaries aim to cause severe disruption, permanent data loss, or sabotage. Common scenarios include:
Destructive cyber-attacks:
Nation-state sponsored attacks targeting critical infrastructure or government entities to disrupt operations.
Attacks intended to destroy evidence or cover attacker tracks after data exfiltration.
Ransomware attacks:
Attackers threaten or execute disk wiping if ransom demands are not met.
Wiping disk structures as punishment or retaliation for non-payment.
Sabotage and espionage:
Attacks against industrial control systems (ICS), critical infrastructure, or sensitive government systems to disrupt operations.
Military or political conflicts where cyber warfare is leveraged.
Attack stages where this technique is typically observed:
Late-stage attacks after initial infiltration, lateral movement, and data exfiltration.
Final stage of ransomware or extortion campaigns.
Post-compromise activity to destroy forensic evidence and impede incident response.
Detection of Disk Structure Wipe involves monitoring, alerting, and analyzing suspicious disk-level activities. Common detection methods include:
Endpoint Detection and Response (EDR) tools:
Monitor and alert on suspicious direct disk access or low-level system calls.
Detect unauthorized use of disk management utilities (e.g., diskpart, dd).
File Integrity Monitoring (FIM):
Detect unexpected modifications or deletions of critical system files, boot records, or partition tables.
Alert on unauthorized changes to MBR, GPT, or file system metadata.
System and event log monitoring:
Monitor Windows Event Logs for unusual disk management commands or unauthorized driver installations.
Linux/Unix system logs for suspicious commands, direct device writes (e.g., /dev/sda), or kernel-level activity.
Behavioral analysis and anomaly detection:
Identify unusual patterns of disk activity, such as high-volume writes to critical disk sectors.
Detect execution of known disk wiping utilities or malware.
Specific Indicators of Compromise (IoCs):
Unexpected system reboot followed by boot failures.
Presence of suspicious executables or scripts capable of direct disk manipulation.
Unauthorized use of disk management tools or low-level disk access APIs.
Detection of known disk wiping malware signatures or file hashes.
Sudden disappearance or corruption of critical disk structures (MBR, GPT, MFT).
Detecting Disk Structure Wipe early is critical due to its severe impact on systems, data, and business continuity. Importance includes:
Prevention of permanent data loss:
Early detection allows incident responders to isolate affected systems and minimize data destruction.
Facilitates quicker recovery from backups or snapshots.
Minimizing operational downtime:
Early detection prevents widespread system outages and disruption of critical business functions.
Reduces recovery time and associated business losses.
Preventing damage escalation:
Early identification of destructive attacks enables containment and prevents lateral movement or further compromise.
Limits attackers' ability to destroy forensic evidence, preserving critical data for investigations.
Maintaining business reputation and compliance:
Avoids prolonged downtime or data breaches that negatively impact customer trust, regulatory compliance, and business reputation.
Demonstrates proactive cybersecurity posture and preparedness against destructive cyber threats.
Real-world examples involving Disk Structure Wipe include:
NotPetya (2017):
Global cyberattack initially disguised as ransomware.
Overwrote MBR, rendering systems unbootable and causing extensive damage to global businesses, including Maersk and Merck.
Utilized modified version of Petya ransomware, which targeted disk structures directly, causing permanent data loss and massive operational disruption.
Shamoon (2012, 2016, and 2018):
Destructive malware targeting oil and gas companies, primarily in the Middle East.
Overwrote MBR and critical disk structures, rendering thousands of systems unusable.
Caused significant operational downtime and required extensive restoration efforts.
Olympic Destroyer (2018):
Targeted Winter Olympics in Pyeongchang, South Korea.
Malware deleted shadow copies, corrupted boot records, and rendered systems unbootable.
Caused disruption to internet access, broadcasting systems, and ticketing services during the event.
WhisperGate (2022):
Malware used in cyber operations against Ukrainian government and corporate systems.
Overwrote MBR with ransom-like message, but without actual ransom capability, indicating destructive intent.
Resulted in permanent damage to disk structures and significant operational disruption.
These examples demonstrate the severe consequences associated with Disk Structure Wipe attacks, underscoring the importance of proactive detection and mitigation strategies.