Shamoon
Shamoon is a malware family referenced in the provided content as one of the malware families observed using steganography to hide communications or payloads inside image files. The content specifically lists Shamoon alongside Microcin, NetTraveler, Zberp, KinS, ZeusVM, and Triton as examples cited by Securelist. The material does not provide detailed TTPs for Shamoon itself beyond this steganography association. Shamoon is also mentioned in connection with a December 2018 wave of attacks: Symantec reported that the Iranian-aligned espionage group Elfin (APT33) came under scrutiny after being linked to that Shamoon wave, but Symantec stated it found no further evidence that Elfin was responsible. One Saudi victim of the Shamoon activity had also recently been attacked by Elfin and infected with Stonedrill. Based on the provided content, the high-confidence description is limited to Shamoon’s mention as malware associated with steganographic techniques and its appearance in reporting around the December 2018 attacks in Saudi Arabia.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malware/activity cluster explicitly listed as using steganography in attacks.
Referenced as a distinct group associated with a wave of attacks in Saudi Arabia; the content notes speculation about links to Elfin but says no further evidence supports Elfin being responsible.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.