2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, adversaries performed a factory-reset on compromised devices that hampered forensic investigations.1
tfMITRE ATT&CK technique
Firmware Corruption T1495
- Tactic
- Impact
- Platforms
- Linux, macOS, Network Devices, Windows
- Version
- 1.3
- Created
- 12 April 2019
- Last modified
- 12 May 2026
Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.[1] Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.1
Campaigns72nd pct
Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.2
Tools & malware51st pct
Tools & malware51st percentile · 44% of ATT&CK techniques have fewer tools implementing them.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.