Loading story…
Palo Alto Networks Unit 42 reported that Shamoon 3 resurfaced as a destructive malware campaign using a modified open-source wiper, continuing the lineage of the Shamoon attacks that targeted organizations in the Middle East. The malware was designed to overwrite files and disrupt operations, indicating an intent to cause large-scale system damage rather than conduct espionage or financially motivated crime.
Researchers said the updated wiper included a verse from the Quran embedded in the malware, a notable artifact in the sample’s construction, while its use of altered open-source code highlighted how destructive tooling can be rebuilt from publicly available components. The findings underscored that Shamoon remained an active threat capable of being adapted for renewed disruptive attacks against enterprise environments.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published a report on Shamoon 3, describing it as a modified open-source wiper that contained a verse from the Quran. No additional incident dates or discrete prior events are provided in the reference content.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported a second wave of **Shamoon 2** attacks, a destructive malware campaign that targeted organizations in the Middle East and used disk-wiping functionality to disrupt operations. The activity followed the re-emergence of the Shamoon malware family and reflected a renewed effort to damage systems rather than steal data, with infected machines rendered unusable after the malware overwrote critical files and the master boot record. The report identified the campaign as part of the broader **Shamoon 2** resurgence, indicating that attackers continued to refine and redeploy the wiper against regional targets after the initial incidents. For defenders, the attacks underscored the risk posed by destructive malware in enterprise environments, particularly where lateral movement and insufficient segmentation can allow a wiper to spread quickly and cause widespread operational outages.
Jul 12, 2026
Shamoon, also tracked as **Disttrack** and `W32.Disttrack`, was used in destructive attacks against energy-sector organizations including **Saudi Aramco** and later **RasGas**, knocking large numbers of Windows systems offline while leaving oil and gas production operations largely unaffected. Saudi Aramco said about **30,000 computers** were impacted, and RasGas took desktops, email, and web servers offline after detecting similar malicious activity. Security reporting tied the incidents to a targeted campaign against Middle Eastern energy firms rather than conventional cybercrime, with the malware designed to cause disruption instead of maintain stealthy access. Researchers described Shamoon as a three-part framework consisting of a **dropper**, **wiper**, and **reporter** module. After spreading through administrative shares in Windows environments, it collected selected data, reported infection statistics to operators, and then used a legitimately signed disk driver to overwrite files and corrupt the **Master Boot Record (MBR)**, rendering machines unusable; some analyses also noted a built-in kill timer and development artifacts linked to the name “Shamoon.” Later reporting said the malware resurfaced after its initial 2012 attacks, reinforcing its reputation as an effective if relatively unsophisticated wiper built for high-impact sabotage against enterprise IT networks.
Jun 29, 2026
Shamoon 2 resurfaced as a destructive **Disttrack** malware campaign targeting organizations in Saudi Arabia, reviving tooling and tradecraft associated with the 2012 Shamoon attacks. Researchers said the malware was built to overwrite files, corrupt partition data, and render systems unusable by abusing the signed **EldoS RawDisk** driver to access and wipe protected disk structures including the **MBR** and partition tables. Analysis of both the 2012 and 2016-era samples showed the malware masquerading as legitimate Windows components such as `trksvr.exe`, reusing service-related artifacts and disk-wiping functionality consistent with the original Shamoon family. The later attack waves relied on stolen administrator credentials, **RDP** access, a compromised internal distribution server, **PAExec**, and batch scripts to copy and execute Disttrack across named hosts identified through Active Directory and prior reconnaissance. Palo Alto Networks reported that infected hosts attempted to spread to as many as 256 additional IP addresses on their local subnet, while the malware’s hardcoded wipe timing and non-operational C2 indicated the operation prioritized destruction over persistence. Separate Securelist research also described a related **Shamoon-themed** wiper using RawDisk and MBR-erasure techniques, but assessed it as a likely copycat rather than the original Iran-targeting wiper, underscoring how Shamoon’s destructive methods continued to influence later malware development.
Aug 15, 2026