Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Shamoon 3 Targets Oil and Gas Organization

Summary: On December 10, a new Disttrack wiper variant sharing substantial code with the Shamoon 2 attacks of 2016 and 2017 was submitted to VirusTotal, and Saipem disclosed it was hit by a Shamoon variant that crippled 300 systems and forced restoration work. Unlike earlier Shamoon wipers, this sample overwrites the MBR, partitions, and files with randomly generated data rather than an image, and it lacks the stolen credentials needed to spread across a local network.

Bottom line: Saipem's 300 crippled systems show what a wiper does to an oil and gas operator: it destroys the machine's boot record and files, then reboots, leaving nothing to recover - and this variant had to be placed on each target by hand, meaning someone already had access.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related