Second Wave of Shamoon 2 Attacks Identified
Summary: Unit 42 identified a second Shamoon 2 attack that used a new 64-bit Disttrack wiper configured to wipe systems on November 29, 2016 at 1:30 AM Saudi Arabia time, targeting a second organization in Saudi Arabia twelve days after the November 17 attack. The payload carried 16 hardcoded account credentials, including usernames and passwords from official Huawei documentation for its FusionCloud virtual desktop infrastructure, and spread across the local /24 network using legitimate domain credentials, copied files such as ntertmgr64.exe, and a scheduled task creating a service named NtertSrv.
What you should know: VDI snapshots are one of the few countermeasures that let an organization recover from a wiper, and this payload carried Huawei VDI credentials that could let an attacker log into the management interface and destroy the snapshots too - so the recovery path itself becomes a target.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026