T1491.001

Official Description

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)(Citation: Varonis) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)

Tactics: Impact
Platforms: ESXi, Linux, macOS, Windows
Parent Technique: T1491 · Defacement
MITRE Version: 1.2
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (2)

The payload changed the desktop wallpaper to a Pakistani flag and displayed a persistent, threatening overlay. KMS Auto Abuse Led to Mining, Remote Access Tools and Ransomware-Themed Scareware; APT36 Link Unconfirmed
ShinyHunters left a defacement message on the hacked FBI jobs site. Dutch Police Arrest Former Hacker in ShinyHunters Investigation

CVE (1)

Threat Actors (15)

MITRE ATT&CK (9)

Vendors (1)

Products (3)

Tools (2)

Industries (7)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.