Shamoon

Shamoon is a notorious malware, specifically a wiper, known for its destructive capabilities. It first gained significant attention in 2012 when it was used in a crippling attack on Saudi Aramco, damaging around 30,000 systems within the company. Iran's Islamic Revolutionary Guard Corps (IRGC) has been associated with this disruptive attack, which targeted oil and gas companies in Saudi Arabia and Qatar. The Shamoon wiper has since been widely available on open-source platforms such as GitHub, allowing various threat actors to use it in their malicious activities. The BlackJack group and the Twelve group are two such entities that have utilized versions of Shamoon in their attacks. Notably, these groups have employed a version of Shamoon rewritten in Go, differing from the original C# variant. This shift in language supports the connection between these groups. Both groups deploy Shamoon or its components identically, placing them in the same directories. KSN data further reveals that a specific variant of Shamoon involved in BlackJack group attacks was also observed in some Twelve group attacks. One victim of Shamoon in Saudi Arabia had previously been attacked by another group, Elfin, and infected with the Stonedrill malware. Elfin is known to utilize Trojan.Stonedrill in its operations. However, despite the complexity of some of these attacks, many threat actors don't need sophisticated wipers to be effective, as demonstrated by the effectiveness of Shamoon and AcidRain. AutoFocus customers can monitor this and previous Shamoon attacks using the Disttrack tag.