Activity timeline
T1561.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 5 reports, and 10 of the 10 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1561.001 Disk Content Wipe is catalogued by MITRE ATT&CK under the Impact tactic in the Enterprise matrix, as a sub-technique of T1561 Disk Wipe. Threadlinqs maps 10 of 2623 tracked threats (0.4%) to it; by severity that is 2 critical, 5 high, 3 medium.
Threats that use T1561.001 most often also use T1082 System Information Discovery (6 threats), T1190 Exploit Public-Facing Application (6 threats), T1005 Data from Local System (5 threats), T1071.001 Web Protocols (5 threats), T1490 Inhibit System Recovery (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
9 tracked threat actors appear in the threats that use T1561.001; the most frequent are Static Tundra (2), ALPHV (1), BlackCat (1), FSB Center 16 (1), Gamaredon Group (1).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1561.001.
Data sources
Telemetry that can reveal T1561.001, per MITRE ATT&CK.
- Command — Command Execution
- Drive — Drive Access, Drive Modification
- Driver — Driver Load
- Process — Process Creation
Threat actors using it
Tracked threats
10 tracked threats use T1561.001.
- Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey Ransomware, and Nemo Wiper Against Russian…high
- ORB Networks and Nation-State CNI Targeting: Destructive Wiper Attack on Polish Energy Infrastructure via…high
- Hacktivism as Hybrid Warfare: NoName057(16), Killnet, and Handala Hack Escalate Coordinated Disruption…high
- Anubis Ransomware Group Confirms Data Theft in Coca-Cola Fairlife Attack Tied to CitrixBleed 2…critical
- Passive DNS Pivoting Uncovers 122 New ACTINIUM (Gamaredon) Infrastructure Domainsmedium
- 313 Team Iran-Aligned Hacktivists Weaponize Agentic AI, Mirai-Derived Botnets, and Prompt Injection Against…high
- CVE-2026-50661: Windows BitLocker Security Feature Bypass 0-Daymedium
- Former DigitalMint Ransomware Negotiator Angelo Martino Sentenced to 70 Months for BlackCat/ALPHV Extortion…medium
- Backdoored Cemu v2.6 GitHub Release — TeamPCP Supply Chain Campaign Extends to Cemu Nintendo Wii U Emulator…high
- Static Tundra ICS Attacks on Polish Energy Infrastructure with DynoWipercritical
Detection coverage
Threadlinqs maintains 13 detection rules mapped to T1561.001 (SPL 4, KQL 3, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1561 Disk Wipe — 35 tracked threats at the technique level.