Threat Brief: Credential Theft - The Keystone of the Shamoon 2 Attacks
Summary: Unit 42 tracked Shamoon 2 across three attack waves on November 11, 2016, November 29, 2016, and January 23, 2017, and reports that credential theft is the keystone of each stage by which the attackers enter and spread through a network. In one sample the researchers found 844 hostnames, and with each system attempting to spread to 256 more, a single distribution server could try to reach 216,064 systems; wave 2 also showed targeting of virtual desktop infrastructure with default credentials.
What's compelling: The report states plainly that if an organization can prevent credential theft, the Shamoon 2 attacks cannot succeed - which puts 844 harvested hostnames and a potential 216,064-system spread on the other side of that one control.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026