Destructive attacks: How to break the chain before systems go dark

This article is part of our Opinions section, where we invite industry professionals to share their views on the most pressing technology questions of our time.

In this article, Alex Holland, Principal Threat Researcher in the HP Security Lab, examines how destructive cyberattacks can bring organisations to a standstill without following the traditional ransomware playbook. 

The first call comes early in the morning. A remote employee cannot access their laptop. Soon after, core business applications are offline. By the time IT teams reach the office, endpoints have been wiped, and backups have been targeted. There is no ransom note. 

This is not ransomware. In a destructive attack, the attacker’s objective is to stop the business from operating and make recovery harder.

The wipe is only the final stage. These attacks usually begin with stolen access, then move toward administrative systems that control identity, backups, cloud infrastructure and device fleets. Every step before impact is a chance to break the chain.

Stage one: getting in

Before an attacker can destroy systems, they need a way in. Increasingly, that means signing in with stolen credentials or valid session tokens.

Those credentials and tokens may come from phishing, malicious downloads, poisoned search results or compromised websites. Infostealers can harvest usernames, passwords, browser cookies and active session tokens from employee devices. Attackers can also buy access from underground markets instead of stealing it themselves.

The risk is what that access unlocks. Destructive attackers want maximum disruption, so they look for accounts and services that give them broad reach across the environment. 

Supply chain compromise creates another route through trusted software. NotPetya spread through a compromised software update mechanism before moving beyond its intended target and causing an estimated US$10 billion in damage. In that case, trust in routine software updates became the delivery mechanism.

Stage two: moving toward control

Once attackers are inside, they try to turn access into administrative control. Their targets are the consoles and platforms that can change the environment at scale. That includes identity infrastructure, cloud administration, remote access, device management, backup and hypervisor systems. 

These systems are valuable because they can push changes across infrastructure, disable protections and slow recovery. In many incidents, reaching them does not require an advanced exploit. Weak credential reset processes, missing MFA and privileged sessions launched from compromised endpoints can give attackers the control they need. 

Stage three: the wipe

The final stage is impact. Wiper malware can destroy boot-critical data so devices cannot start. Some attacks pose as ransomware and display a payment demand, even though no recovery key exists. Others use the organisation’s own management tools to trigger remote wipes, factory resets or bulk device deletions.

The worst attacks can reach below the operating system into firmware. At that point, recovery is no longer as simple as reinstalling the OS. If firmware has been tampered with, an attacker’s foothold can persist beneath a clean OS image. Teams need to know whether an endpoint can be trusted before it returns to service. 

Once the wipe begins, the priority shifts to restoring operations quickly and securely from a trusted foundation.

Resilience against destructive attacks

Destructive attacks require a resilience model designed to limit operational disruption. The priority is to close off the access routes attackers rely on most, limit what a compromised endpoint can reach and preserve recovery paths that remain trustworthy after destructive payloads are deployed.

That model has to work across the attack chain. At the access stage, organisations need to isolate risky files, links and websites before they reach the host system. They also need phishing-resistant MFA and monitoring for exposed credentials. 

At the control stage, administrative sessions should be isolated from the local endpoint. Even if the device is compromised, malware should not be able to capture keystrokes, view screen content or steal session information from privileged activity. 

At the impact stage, recovery needs to start from a trusted foundation. That means validated firmware integrity and secure OS recovery, so IT teams can confirm an endpoint is safe before returning it to service.

The lesson is not that every destructive attack can be stopped at the perimeter. It is that organisations can make destruction harder to execute and recovery faster when the worst happens. The strongest defenses assume compromise, reduce attacker reach and give IT teams a trusted path to restore systems across the fleet.

More security-related articles

• Martin Riley, CTO at Bridewell: “AI development has been a genuine enabler for businesses that have adopted it properly.”
• Ransomware is a data theft business now. Most defences still guard the wrong door.
• Signal adds automatic key verification to help prevent Person-in-the-Middle attacks