Threat intelligence / Technique

Internal Defacement

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)(Citation: Varonis) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

17 recorded

Relationships

mitigates

from Data Backup

Mitigation

subtechnique-of

to Defacement

Technique

uses

from Black Basta

Malware

uses

from BlackByte

Group

uses

from BlackCat

Malware

uses

from Diavol

Malware

uses

from Gamaredon Group

Group

uses

from INC Ransomware

Malware

uses

from Lazarus Group

Group

uses

from Meteor

Malware

uses

from Qilin

Malware

uses

from RansomHub

Malware

uses

from Remcos

Tool

uses

from ROADSWEEP

Malware

uses

from SameCoin

Malware

uses

from ShinyHunters

Group

uses

from ShrinkLocker

Malware

4 external

References

mitre-attack

T1491.001

open

Varonis

https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire

open

Novetta Blockbuster Destructive Malware

https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf

open

Novetta Blockbuster

https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf

open