Procedure examples

APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.

BlackByte deleted ransomware executables post-encryption.

APT3 has a tool that can delete files.

Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk. Kimsuky has deleted files using the `Remove-Item` PowerShell commandlet to remove traces of executed payloads. Kimsuky has also removed remnants of files used for delivery to include .log and .zip files.

Volt Typhoon has run `rd /S` to delete their working directories and deleted systeminfo.dat from `C:\Users\Public\Documentsfiles`.

Patchwork removed certain files and replaced them so they could not be retrieved.

APT41 deleted files from the system.

Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.

Evilnum has deleted files used during infection.

A menuPass macro deletes files after it has decoded and decompressed them.

APT32's macOS backdoor can receive a “delete” command.

FIN6 has removed files from victim machines.

Gamaredon Group tools can delete files used during an operation.

TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.

Sandworm Team has used backdoors that can delete files used in an attack from an infected system.

APT18 actors deleted tools and batch files from victim systems.

Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.

Rocke has deleted files on infected machines.

APT39 has used malware to delete files after they are deployed on a compromised host.

UNC3886 has used the the esxcli command line to remove files created by malicious vSphere Installation Bundles from disk.

Contagious Interview has configured malware to remove archives used in collection activities following successful exfiltration.

OilRig has deleted files associated with their payload after execution.

Tropic Trooper has deleted dropper files on an infected system using command scripts.

Aquatic Panda has deleted malicious executables from compromised machines.

The White Company has the ability to delete its malware entirely from the target system.

Malware used by Group5 is capable of remotely deleting files from victims.

RedCurl has deleted files after execution.

FIN5 uses SDelete to clean up the environment and attempt to prevent detection.

APT29 has used SDelete to remove artifacts from victim networks.

Chimera has performed file deletion to evade detection.

MirrorFace has deleted directories containing malware and archives with files collected from the victim environment.

Medusa Group has deleted previously installed tools.

The BRONZE BUTLER uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated.

Ember Bear deletes files related to lateral movement to avoid detection.

APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.

Metador has quickly deleted `cbd.exe` from a compromised host following the successful deployment of their malware.

APT5 has deleted scripts and web shells to evade detection.

Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.

INC Ransom has uninstalled tools from compromised endpoints after use.

Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.

Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.

Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.

Play has used tools including Wevtutil to remove malicious files from compromised hosts.

Magic Hound has deleted and overwrote files to cover tracks.

Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.

FIN10 has used batch scripts and scheduled tasks to delete critical system files.

FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.