System Shutdown/Reboot
Technique · ATTACK:enterprise:T1529
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1529",
"title": "System Shutdown/Reboot",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1529",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--ff73aa03-0090-4464-83ac-f89e233c02bc",
"external_id": "T1529",
"domain": "enterprise",
"created": "2019-10-04T20:42:28.541Z",
"modified": "2026-05-12T15:12:00.726Z",
"version": "1.5",
"aliases": [
],
"tactics": [
"impact"
],
"source_references": [
{
"source_name": "Talos Nyetya June 2017",
"url": "https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html"
},
{
"source_name": "alert_TA18_106A",
"url": "https://www.cisa.gov/uscert/ncas/alerts/TA18-106A"
},
{
"source_name": "NotMe-BSOD",
"url": "https://github.com/lzcapp/NotMe-BSOD"
},
{
"source_name": "Talos Olympic Destroyer 2018",
"url": "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
},
{
"source_name": "Microsoft Shutdown Oct 2017",
"url": "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown"
},
{
"source_name": "NtRaiseHardError",
"url": "https://ntdoc.m417z.com/ntraiseharderror"
},
{
"source_name": "Unit42 Agrius 2023",
"url": "https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"
},
{
"source_name": "SonicWall",
"url": "https://www.sonicwall.com/blog/disarming-darkgate-a-deep-dive-into-thwarting-the-latest-darkgate-variant"
},
{
"source_name": "CrowdStrike Blog",
"url": "https://www.crowdstrike.com/en-us/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"
}
]
}Explicit source assertions (32)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--056322fc-63b3-491a-9064-218b4efc9ed7
ESET DynoWiper Update JAN 2026 · ESET DynoWiper JAN 2026ATTACK:enterprise:S1125 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--098c0f13-e56f-43ff-8fee-0cce9d771092
AcidRain JAGS 2022ATTACK:enterprise:S1033 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ef5c336-794e-4700-b40e-c78eed74d353
Checkpoint MosesStaff Nov 2021ATTACK:enterprise:S9038 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13ff8433-97c7-40c3-a082-812453731bf2
CERT PolskaATTACK:enterprise:S1136 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17b73eb6-f4a6-49d4-8f72-18796cf7d553
Unit42 Agrius 2023ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1caaad2f-7a84-4e32-8134-edac0c4fcc72
Picus Qilin MAR 2025ATTACK:enterprise:S1135 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20d59bcb-04cd-4581-a18f-4f77dd96027c
Unit42 Agrius 2023ATTACK:enterprise:S1167 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30c9b855-cb8e-43ab-8f4c-ffef015789d6
SentinelOne AcidPour 2024ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--394fe21a-c7a6-4571-abf5-03377b934634
Aikido CanisterWorm MAR 2026ATTACK:enterprise:S0372 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c7bb2a4-eede-4dae-ac41-03782729a961
Wired Lockergoga 2019ATTACK:enterprise:S0365 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4932951a-b313-4024-bbad-434de3b747c5
Talos Olympic Destroyer 2018 · US District Court Indictment GRU Unit 74455 October 2020ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53c8e757-8043-4d08-8bd6-8d02d2b973cb
FireEye APT38 Oct 2018ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5978688d-f172-4af5-bfc6-f62789492766
CheckPointResearch_TheGentlemen_April2026ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62c1a647-4a39-45b1-8d68-99b19ec12a78
Sophos Maze VM September 2020ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63759ea4-5bf1-408d-a1cc-e7f52e3aca1b
Talos Group123ATTACK:enterprise:S0582 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66d53000-135b-448d-988a-3ff5d53b2c5b
Proofpoint LookBack Malware Aug 2019ATTACK:enterprise:S1133 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a8c7cab-bdf7-43dc-960b-84f47767f2df
SentinelOne Agrius 2021ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97453382-d064-4705-9a63-b21356d4bfce
Cisco Ukraine Wipers January 2022ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d6c5d09-94b9-4453-a26d-8b3ac79cfe7f
Trend Micro KillDisk 2ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a506c8b0-572d-470f-b90b-146a81385d13
Google XLoader 2017ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6bb7182-2459-406d-89c1-51b20f1a88f7
Kaspersky ShrinkLocker 2024ATTACK:enterprise:S0368 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa158d48-a9f5-49bb-8f15-166705f29b36
Talos Nyetya June 2017 · US District Court Indictment GRU Unit 74455 October 2020ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aba4a71f-ddee-428b-a454-9842fd8750fd
Elastic Latrodectus May 2024ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b153b867-6888-4071-bf34-d40305ca4150
Mandiant ROADSWEEP August 2022ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc31afad-6349-4b66-a0a9-cd8f9de46aec
US-CERT SHARPKNOT June 2018ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2ff2c76-04ed-41c4-bd35-75f7cf823aee
Unit 42 Shamoon3 2018 · McAfee Shamoon December 2018ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d82bfd25-1dab-45a6-ad66-1eeb6190a63a
Rapid7 BlackBasta 2024ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d82f1883-45a6-4b1e-ab7c-e5a3342a3cb9
Trend Micro Black Basta May 2022ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc81d3d6-c3e6-4f95-8143-e2da3ab5232a
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e87ba6d8-8228-45af-b235-54a0e0666a23
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f86b3fe5-c004-4fed-aaac-cf7d68b8d315
SentinelOne Hermetic Wiper February 2022 · Qualys Hermetic Wiper March 2022ATTACK:enterprise:S1053 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc89b538-26d8-434a-954f-e7d0b384b506
Trend Micro AvosLocker Apr 2022