Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Shamoon 2: Return of the Disttrack Wiper

Summary: Unit 42 found new Disttrack samples used in an updated Shamoon campaign against at least one organization in Saudi Arabia, set to begin wiping data exactly on 2016/11/17 20:45, the start of the Saudi weekend. The malware spreads across the local /24 network using stolen administrator credentials, disables UAC remote restrictions, and uses the same EldoS RawDisk driver and temporary license key as the 2012 attack that damaged 30,000 or more systems.

What's compelling: The attackers hard-coded a stolen internal domain and administrator credentials into the tool and timed the wipe for the start of a weekend, giving it days to spread before anyone was at work - the same timing logic as the 2012 strike on Lailat al Qadr. The wiper overwrites the master boot record and partition tables and then reboots the system, so recovery depends on backups that were never on the same network segment.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related