Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Shamoon 3: Modified Open-Source Wiper Contains Verse from the Quran

Summary: Unit 42 found a second wiper Trojan in the Shamoon 3 incident against an oil and gas organization: a modified variant of the open-source SuperDelete tool, written in C#, that overwrites user files with random data before deleting them and cannot spread on its own. The researchers also identified a Loader Trojan and a Spreader Trojan that propagate the wiper from one compromised system to others using hostname lists the actor built from prior reconnaissance, and found a related SlHost.exe wiper containing Quranic ASCII art that is never displayed.

What's compelling: The wiper overwrites files with random data before deleting them, so recovery is difficult without available backups, and the Spreader Trojan carries no credentials of its own, relying instead on the elevated privileges of the account that ran it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related