SDeleteTool
SDelete is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools.From MITRE ATT&CK
Last reported yesterday, by The Hacker News6 reports
ATT&CK techniques
6 of 26 · each with the sentence it comes from- T1566.001Spearphishing Attachment
“T1566.001”
- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Windows Command Shell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack“The attack culminated with Sandworm carrying out a data-wiping attack by dropping the SDelete utility via Active Directory Group Policy.”
-
MythicRatatoskr: el backdoor que utilizó la red Yggdrasil antes de un ataque destructivo de Sandworm“El ataque de borrado de datos se ejecutó mediante el despliegue de la utilidad SDelete a través de Directivas de Grupo de Active Directory, tácticas, técnicas y procedimientos (TTPs) estándar de Sandworm que hemos observado numerosas veces en la…”
-
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration“The data-wiping attack was executed by deploying the SDelete utility via Active Directory Group Policy – standard Sandworm tactics, techniques, and procedures (TTPs) that we have observed numerous times in ESET telemetry.”
-
141 Key Cybersecurity Statistics for 2026 and Beyond“PSExec, AD Explorer, and SDelete were the most frequently used Sysinternals tools by attackers in 2024.”
-
Hunting for Attacker’s Tactics and Techniques With Prefetch Files“Attackers use data wiping tools, like SDelete, quite often nowadays, so ability to find at least traces of different tactics and techniques usage is a must-have skill for any modern defender.”
-
Troubleshooting Procmon & Sysmon v3.32“Is there a sensitive file you’d like to remove? SDelete FTW.”
Indicators in its reports
named in the reports above- hxxps://uztickets[.]comin 2 reports
- uztickets[.]comin 2 reports
- hxxps://egyptanimals[.]com/animals/photoalbumin 2 reports
- egyptanimals[.]comin 2 reports
- adomd[.]netin 2 reports
- hxxp://51.15.204[.]214/in 2 reports
- 51.15.204[.]214in 2 reports
- d5f9288daebf87ae…cf235b093cfdin 2 reports
- b69ef0e45b401440…5d0c57e87415in 2 reports
- 4e3e6577866e4ce2…ae04230e768fin 2 reports
- 69969eeb7e0a3d84…cf934c6aa388in 2 reports
- 01855153ca7a33ad…12dfba0dd2cain 2 reports
- e29af83a07fb32eb…2e766d53f704in 2 reports
- 028ca11f3f0d8396…31fc2f50f829in 2 reports
- 9085896989947c09…f6b233fc645bin 2 reports
- d7e6a5a46c6ed351…1be0250fd2a2in 2 reports
- 131a371a1e4ee78e…9290ec3b58a6in 2 reports
- 09c816697c0c2aff…8ca30d04c9cdin 2 reports
- 8ceb5f8bcdf4995b…d682613bb17bin 2 reports
- 37.205.14[.]171in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.