Disk Structure Wipe
Subtechnique · ATTACK:enterprise:T1561.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1561.002",
"title": "Disk Structure Wipe",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1561/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--0af0ca99-357d-4ba1-805f-674fdfb7bef9",
"external_id": "T1561.002",
"domain": "enterprise",
"created": "2020-02-20T22:10:20.484Z",
"modified": "2026-05-12T15:12:00.620Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"impact"
],
"source_references": [
{
"source_name": "format_cmd_cisco",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/F_through_K.html#wp2829794668"
},
{
"source_name": "Unit 42 Shamoon3 2018",
"url": "https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"
},
{
"source_name": "Palo Alto Shamoon Nov 2016",
"url": "http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"
},
{
"source_name": "FireEye Shamoon Nov 2016",
"url": "https://web.archive.org/web/20210126065851/https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html"
},
{
"source_name": "Kaspersky StoneDrill 2017",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"
},
{
"source_name": "Microsoft Sysmon v6 May 2017",
"url": "https://docs.microsoft.com/sysinternals/downloads/sysmon"
},
{
"source_name": "Symantec Shamoon 2012",
"url": "https://www.symantec.com/connect/blogs/shamoon-attacks"
}
]
}Explicit source assertions (22)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10bc4c79-d47f-4d49-bc06-c65ae376a4b6
Unit 42 Shamoon3 2018 · Palo Alto Shamoon Nov 2016 · FireEye Shamoon Nov 2016 · Symantec Shamoon 2012ATTACK:enterprise:T1561.002 → subtechnique-of → ATTACK:enterprise:T1561
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1af12953-edeb-4678-91e4-7c70000ee6c3
ATTACK:enterprise:S9002 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26e05910-d743-4959-a177-ff227fc48819
Microsoft_diskpart_Feb2023 · Trendmicro_RansomHub_Dec2024ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2aa6a9d6-57a0-490e-97d0-79d12119ec21
CISA Iran Albanian Attacks September 2022 · Microsoft Albanian Government Attacks September 2022ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a8db293-43a2-45a1-b9b2-32222355bc4e
SentinelOne Hermetic Wiper February 2022 · Symantec Ukraine Wipers February 2022 · Crowdstrike DriveSlayer February 2022 · Qualys Hermetic Wiper March 2022ATTACK:enterprise:S0364 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6add4de1-3af8-4994-b65f-ccb13fdd703a
Palo Alto Shamoon Nov 2016 · Unit 42 Shamoon3 2018ATTACK:enterprise:S1136 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7145e20d-4c16-47bf-bf13-40b4e031d0e5
Unit42 Agrius 2023ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76e8bb0f-83a5-462b-8f7d-3369da104e67
Cisco Ukraine Wipers January 2022 · Crowdstrike WhisperGate January 2022 · Cybereason WhisperGate February 2022 · Unit 42 WhisperGate January 2022 · Microsoft WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8145505d-5f00-4709-a9a9-816c33a04ad0
Splunk ShrinkLocker 2024ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b331f1e-76b5-47a9-81b4-118083a54198
Check Point VOID MANTICORE Handala Hack March 2026ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95f54d2e-cfa0-4afc-a5f4-9da7da55242a
FireEye APT38 Oct 2018ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98b6dbac-dac9-4856-9b67-25c49e20448e
US-CERT Ukraine Feb 2016 · ESET Telebots June 2017ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b00c9e09-d98f-40b4-bc4e-0c3e9fe873e1
Novetta Blockbuster · US-CERT SHARPKNOT June 2018ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b12cc736-ee7a-4a70-b4f0-2048e218310f
Trend Micro KillDisk 1ATTACK:enterprise:S0380 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b32b4e03-1469-4a70-8d0b-cd3344e92b3f
Symantec Elfin Mar 2019ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb495609-5a69-49f1-afb4-4bfa2c9a38f8
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:M1053 → mitigates → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d11e8416-ca1f-46d6-8b95-ed03f708da9c
Ready.gov IT DRPATTACK:enterprise:S1135 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8f9ad2e-1548-45b8-9539-4692add2c0fe
Unit42 Agrius 2023ATTACK:enterprise:S1134 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9297dfb-9b0b-421d-a5f6-05619c778953
SentinelOne Agrius 2021ATTACK:enterprise:S1151 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f419f8fb-8a3c-423d-8d01-20e99eb63693
CISA Iran Albanian Attacks September 2022 · Mandiant ROADSWEEP August 2022 · IBM ZeroCleare Wiper December 2019ATTACK:enterprise:S0693 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9bcef0c-01a5-4fd8-a6f1-8423b5e98e52
ESET CaddyWiper March 2022 · Cisco CaddyWiper March 2022ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fcb6fc55-8fa6-4ec7-a5a3-51de7dd90c1d
FireEye APT37 Feb 2018 · Talos Group123