Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Shamoon 2: Delivering Disttrack

Summary: Since late November 2016, the Shamoon 2 campaign has hit organizations in Saudi Arabia in three waves, with attackers using stolen legitimate credentials over RDP to load a Zip archive onto one compromised system and distribute the Disttrack payload to hostnames taken from Active Directory. The deployment used PAExec and batch scripts to copy and install Disttrack on named hosts, after which the malware attempted to propagate to 256 additional IP addresses on each local network; the files analyzed contained 844 hostnames rather than the 400 text files the scripts referenced.

Why it matters: The attackers did not need a zero-day: stolen credentials and a single compromised distribution server were enough to push a disk-wiping payload across 844 named hosts, and the same IP range hosted a server tied to the Magic Hound campaign, suggesting sustained pre-attack access.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Identity & Access Management
Related