Log in Request a demo

Glossary

Wiper Malware.

Also called wiper, data wiper, destructive malware, disk wiper

In Short

Wiper malware is malicious software that destroys data or makes systems unusable by overwriting or deleting files or disk contents. MITRE ATT&CK covers this behavior under data destruction and disk wipe, and says the aim is to interrupt the availability of systems and networks.

Last updated October 9, 2026
Profile MapGlossary Term
  1. Also Called4other nameswiper · data wiper · destructive malware
  2. Related Terms3linked entriesRansomware · MITRE ATT&CK · Incident response plan

What is wiper malware?

Wiper malware is software built to erase or corrupt data. MITRE ATT&CK does not use the word as a single technique. It describes the behavior in two techniques, Data Destruction (T1485) and Disk Wipe (T1561). MITRE says adversaries use them to interrupt or disrupt availability, meaning that people can no longer use their systems and data.

How does wiper malware work?

MITRE describes two levels of damage.

  • Data Destruction targets individual files. MITRE says adversaries overwrite or delete files so that recovery is difficult, and notes that ordinary delete commands only remove file pointers, so content can be recovered.
  • Disk Wipe targets raw disk data. MITRE says adversaries wipe or corrupt raw disk data, and lists disk content wipe and disk structure wipe as sub-techniques.

MITRE also says Data Destruction malware can spread in a worm-like way across a network, using credential theft and administrative shares. MITRE adds that in the cloud, adversaries can delete storage objects, machine images and databases.

Why does it matter?

The main harm of wiper malware is loss of availability. MITRE describes overwriting files so they are irrecoverable. If backups are also reachable by the attacker, they can be destroyed too. For that reason the quality and protection of backups is central to how an organization can recover.

How can you detect and reduce it?

MITRE lists several detection ideas. Defenders can monitor for recursive delete or overwrite commands, mass file activity, direct disk access with abnormal writes to boot sectors, and batch API calls that delete cloud infrastructure.

MITRE lists these mitigations.

  • Data backup: keep regular backups that are stored separately and protected from unauthorized access or destruction.
  • Multi-factor authentication: use MFA delete for cloud storage so that data cannot be destroyed without a second check.
  • User account management: restrict permissions for modifying cloud lifecycle policies.

MITRE also suggests disaster recovery plans with regular backups.

Is wiper malware the same as ransomware?

No. Ransomware locks or steals data and then demands payment. Wiper malware is described by MITRE as a way to destroy data and disrupt availability. The two can look alike at first because files become unusable, so incident responders need to find out which one they face.

Is deleting a file the same as wiping it?

No. MITRE says standard deletion commands leave recoverable data. Wiping means overwriting so that recovery is hard.

Sources

  • MITRE ATT&CK: Data Destruction: overwriting or deleting files, worm-like spread, cloud deletion, mitigations (backup, MFA delete, account management) and detection ideas.
  • MITRE ATT&CK: Disk Wipe: overwriting disk data, destroying boot records, wiping sectors, worm-like propagation, backup mitigation, Impact tactic.

Also Called.

  • Namewiper
  • Namedata wiper
  • Namedestructive malware
  • Namedisk wiper

Questions.

  • What is wiper malware?

    Wiper malware is software built to erase or corrupt data. It overwrites or deletes files or disk contents so that systems become unusable. MITRE ATT&CK describes the behavior under Data Destruction (T1485) and Disk Wipe (T1561).

  • Is wiper malware the same as ransomware?

    No. Ransomware locks or steals data and then demands payment. MITRE describes wiper malware as a way to destroy data and disrupt availability. They can look alike at first because files become unusable, so responders need to find out which one they face.

  • How can you reduce the damage from wiper malware?

    MITRE lists regular backups stored separately and protected from destruction, MFA delete for cloud storage, and tighter permissions on cloud lifecycle policies. Defenders can also watch for recursive deletes, mass file activity and abnormal writes to boot sectors.

  • Is deleting a file the same as wiping it?

    No. MITRE says standard deletion commands only remove file pointers, so the content can often be recovered. Wiping means overwriting data so that recovery is difficult or impossible.

In Our Research

  1. 1 HermeticWiper Malware Technical Analysis Open Report May 2023
  2. 2 Inside Void Manticore: Iran’s Hybrid Hacktivist for Information Warfare November 2025
  3. 3 Sandworm (APT44): Russia’s Most Destructive Cyber Weapon November 2025
  4. 4 Geopolitical Countdown: The Evolution of Cyberspace from Espionage to Destruction and New Strategies for Corporate Resilience November 2025
  5. 5 APT33/Peach Sandstorm: Threat Forecast and Analysis of a Cloud-Focused Adversary November 2025
  6. 6 APT33 (Elfin / Refined Kitten): Iran’s Longstanding Cyber-Espionage Arm November 2025

Keep Exploring.

Knowledge Hub
Article APT Groups In The MENA Region: Key Threat Actors In Cyber Espionage Overview of APT groups active in the Middle East and North Africa, including MuddyWater, OilRig and SideWinder, their espionage aims and targets. Open Article The Lazarus Group: Espionage, Sabotage, And Cybercrime Under One Umbrella Lazarus Group profile: active since at least 2009, with aliases and major incidents such as Sony Pictures, WannaCry and Bybit, plus defense guidance. Open Threat group APT33 MITRE ATT&CK describes APT33 as a suspected Iranian threat group active since at least 2013, with a particular interest in aviation and energy in the United States, Saudi Arabia and South Korea. CERT-EU's March 2024 brief calls it an Iranian-linked cyberespionage group; no government indictment or sanction naming it was found. Open Threat group APT37 MITRE ATT&CK describes APT37, also called ScarCruft, as a North Korean state-sponsored cyber espionage group that has been active since at least 2012. It targets South Korea first, using spearphishing emails with Hangul (HWP) attachments, compromised websites and cloud services for control. No government advisory opened names the group itself. Open

Browse The Library.