Loading story…
Shamoon, also tracked as Disttrack and W32.Disttrack, was used in destructive attacks against energy-sector organizations including Saudi Aramco and later RasGas, knocking large numbers of Windows systems offline while leaving oil and gas production operations largely unaffected. Saudi Aramco said about 30,000 computers were impacted, and RasGas took desktops, email, and web servers offline after detecting similar malicious activity. Security reporting tied the incidents to a targeted campaign against Middle Eastern energy firms rather than conventional cybercrime, with the malware designed to cause disruption instead of maintain stealthy access.
Researchers described Shamoon as a three-part framework consisting of a dropper, wiper, and reporter module. After spreading through administrative shares in Windows environments, it collected selected data, reported infection statistics to operators, and then used a legitimately signed disk driver to overwrite files and corrupt the Master Boot Record (MBR), rendering machines unusable; some analyses also noted a built-in kill timer and development artifacts linked to the name “Shamoon.” Later reporting said the malware resurfaced after its initial 2012 attacks, reinforcing its reputation as an effective if relatively unsophisticated wiper built for high-impact sabotage against enterprise IT networks.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
On November 30, 2016, Symantec reported that Shamoon had resurfaced and was again being used in destructive attacks. The publication marked the malware family's re-emergence years after the 2012 energy-sector incidents.
In September 2012, further analysis characterized Shamoon's code as relatively unsophisticated while still highly effective at causing destructive impact. The reporting reinforced assessments that the malware was purpose-built for wiping systems rather than stealthy long-term espionage.
Qatar-based RasGas shut down desktop computers, email, and web servers after detecting an unknown virus in late August 2012. The company said production was not affected, and reporting linked the incident to concerns about Shamoon targeting energy firms.
By late August 2012, Saudi Aramco disclosed that the malware incident had disrupted about 30,000 computers. The company reiterated that business systems were affected but oil production systems were not.
Analysis published in late August 2012 reported that Shamoon contained a kill timer, suggesting a preconfigured execution schedule and a possible connection to the Saudi Aramco incident. This added new technical insight into how the malware was designed to trigger its destructive phase.
On 2012-08-23, a group calling itself the 'Cutting Sword of Justice' claimed responsibility for the August 15 malware attack on Saudi Aramco, describing it as retaliation for Saudi government actions. The group said about 30,000 computers were destroyed, posted alleged infected IP addresses as proof, and threatened a second attack for the following Saturday.
Symantec disclosed technical details on August 16, 2012, describing W32.Disttrack as destructive malware used in targeted attacks against at least one energy-sector organization. It outlined the malware's Dropper, Wiper, and Reporter components and its ability to spread via administrative shares, overwrite files, and corrupt the master boot record.
Saudi Aramco was struck by the Shamoon (Disttrack) malware in mid-August 2012 after it reportedly entered through personal computers on the network. The attack disrupted corporate systems while the company said oil production and operational plant systems were not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
15 references tracked. Mallory keeps watching after this page renders.
security.com
Open sourcedarkreading.com
Open sourcebbc.co.uk
Open sourcecnet.com
Open sourcearstechnica.com
Open sourcearstechnica.com
Open sourcecommunity.broadcom.com
Open sourceblackhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Shamoon 2 resurfaced as a destructive **Disttrack** malware campaign targeting organizations in Saudi Arabia, reviving tooling and tradecraft associated with the 2012 Shamoon attacks. Researchers said the malware was built to overwrite files, corrupt partition data, and render systems unusable by abusing the signed **EldoS RawDisk** driver to access and wipe protected disk structures including the **MBR** and partition tables. Analysis of both the 2012 and 2016-era samples showed the malware masquerading as legitimate Windows components such as `trksvr.exe`, reusing service-related artifacts and disk-wiping functionality consistent with the original Shamoon family. The later attack waves relied on stolen administrator credentials, **RDP** access, a compromised internal distribution server, **PAExec**, and batch scripts to copy and execute Disttrack across named hosts identified through Active Directory and prior reconnaissance. Palo Alto Networks reported that infected hosts attempted to spread to as many as 256 additional IP addresses on their local subnet, while the malware’s hardcoded wipe timing and non-operational C2 indicated the operation prioritized destruction over persistence. Separate Securelist research also described a related **Shamoon-themed** wiper using RawDisk and MBR-erasure techniques, but assessed it as a likely copycat rather than the original Iran-targeting wiper, underscoring how Shamoon’s destructive methods continued to influence later malware development.
Aug 15, 2026
Palo Alto Networks Unit 42 reported that **Shamoon 3** resurfaced as a destructive malware campaign using a modified open-source wiper, continuing the lineage of the Shamoon attacks that targeted organizations in the Middle East. The malware was designed to overwrite files and disrupt operations, indicating an intent to cause large-scale system damage rather than conduct espionage or financially motivated crime. Researchers said the updated wiper included a verse from the Quran embedded in the malware, a notable artifact in the sample’s construction, while its use of altered open-source code highlighted how destructive tooling can be rebuilt from publicly available components. The findings underscored that Shamoon remained an active threat capable of being adapted for renewed disruptive attacks against enterprise environments.
Jul 12, 2026
Palo Alto Networks Unit 42 reported a second wave of **Shamoon 2** attacks, a destructive malware campaign that targeted organizations in the Middle East and used disk-wiping functionality to disrupt operations. The activity followed the re-emergence of the Shamoon malware family and reflected a renewed effort to damage systems rather than steal data, with infected machines rendered unusable after the malware overwrote critical files and the master boot record. The report identified the campaign as part of the broader **Shamoon 2** resurgence, indicating that attackers continued to refine and redeploy the wiper against regional targets after the initial incidents. For defenders, the attacks underscored the risk posed by destructive malware in enterprise environments, particularly where lateral movement and insufficient segmentation can allow a wiper to spread quickly and cause widespread operational outages.
Jul 12, 2026