Threat Brief: Second Wave of Shamoon 2 Attacks Reveal Possible New Tactic
Summary: Palo Alto Networks Unit 42 uncovered a previously unknown second wave of Shamoon 2 attacks timed for November 29, 2016, twelve days after the initial attacks, again using the Disttrack wiper malware configured to operate without command and control servers. The latest sample contained credentials for virtual desktop infrastructure solutions such as Huawei's FusionCloud, which Unit 42 says may indicate attackers intended to also strike the VDI deployment and its snapshots.
Why it matters: VDI snapshots are often the primary line of backup against a wiper attack, so credentials that let an attacker destroy both the systems and those snapshots remove the recovery path an organization is counting on.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026