Loading story…
Shamoon 2 resurfaced as a destructive Disttrack malware campaign targeting organizations in Saudi Arabia, reviving tooling and tradecraft associated with the 2012 Shamoon attacks. Researchers said the malware was built to overwrite files, corrupt partition data, and render systems unusable by abusing the signed EldoS RawDisk driver to access and wipe protected disk structures including the MBR and partition tables. Analysis of both the 2012 and 2016-era samples showed the malware masquerading as legitimate Windows components such as trksvr.exe, reusing service-related artifacts and disk-wiping functionality consistent with the original Shamoon family.
The later attack waves relied on stolen administrator credentials, RDP access, a compromised internal distribution server, PAExec, and batch scripts to copy and execute Disttrack across named hosts identified through Active Directory and prior reconnaissance. Palo Alto Networks reported that infected hosts attempted to spread to as many as 256 additional IP addresses on their local subnet, while the malware’s hardcoded wipe timing and non-operational C2 indicated the operation prioritized destruction over persistence. Separate Securelist research also described a related Shamoon-themed wiper using RawDisk and MBR-erasure techniques, but assessed it as a likely copycat rather than the original Iran-targeting wiper, underscoring how Shamoon’s destructive methods continued to influence later malware development.
TTPs, infrastructure, and targeting history in one profile.
11 events from the most recent confirmed update back to the earliest known activity.
Analyzed Disttrack samples from the renewed campaign were configured to begin wiping data at 20:45 on 2016-11-17. Researchers noted the timing aligned with the start of the Saudi weekend.
Beginning in late November 2016, Shamoon 2 conducted three waves of destructive attacks against organizations in Saudi Arabia. The operation relied on stolen credentials, remote access, and internal distribution mechanisms to deploy Disttrack.
In November 2016, Unit 42 identified new Disttrack samples tied to an updated Shamoon campaign targeting at least one organization in Saudi Arabia. The malware reused key elements associated with the 2012 Shamoon attacks.
On 2012-08-16, two Shamoon/DistTrack samples were observed on VirusTotal with detection ratios of 22/42 and 21/42. Multiple vendors identified them as DistTrack-family malware.
Two Shamoon/DistTrack malware samples analyzed later carried PE timestamps of 2012-08-10 00:46:22+02:00, indicating the binaries were built by that date. The samples masqueraded as the Windows Distributed Link Tracking Server executable.
In August 2012, the original Shamoon campaign targeted a Saudi Arabian energy company with Disttrack malware. The attack damaged 30,000 or more systems.
After comparing the sample with the malware used against Iran in April 2012, researchers concluded it was probably not the same original Wiper malware. They cited differences in service names, driver filename patterns, and disk-wiping behavior, and assessed it was more likely a copycat inspired by earlier destructive attacks.
Over a 24-hour telemetry window, researchers observed only two sightings of Trojan.Win32.EraseMBR.a, both apparently involving security researchers in China. They concluded the malware was not widespread and was likely used in narrowly targeted attacks.
Kaspersky researchers said they received a collection of malware samples from another anti-malware company, including one containing the path string "C:\Shamoon\ArabianGulf\wiper\release\wiper.pdb". Analysis showed it abused a signed EldoS driver for raw disk access and MBR wiping.
Unit 42 reported a possible but unconfirmed connection between Shamoon 2 and the Magic Hound campaign based on overlapping Saudi targeting, similar cloud-hosted infrastructure, and use of PowerShell and Meterpreter. The evidence was described as suggestive rather than conclusive.
During the Shamoon 2 operation, attackers first compromised an internal system used as a Disttrack distribution server, accessed it over RDP with stolen credentials, and downloaded a ZIP archive containing deployment tools and hostname lists. The recovered materials showed a semi-automated method for copying and executing Disttrack across named hosts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourcecontagiodump.blogspot.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Shamoon, also tracked as **Disttrack** and `W32.Disttrack`, was used in destructive attacks against energy-sector organizations including **Saudi Aramco** and later **RasGas**, knocking large numbers of Windows systems offline while leaving oil and gas production operations largely unaffected. Saudi Aramco said about **30,000 computers** were impacted, and RasGas took desktops, email, and web servers offline after detecting similar malicious activity. Security reporting tied the incidents to a targeted campaign against Middle Eastern energy firms rather than conventional cybercrime, with the malware designed to cause disruption instead of maintain stealthy access. Researchers described Shamoon as a three-part framework consisting of a **dropper**, **wiper**, and **reporter** module. After spreading through administrative shares in Windows environments, it collected selected data, reported infection statistics to operators, and then used a legitimately signed disk driver to overwrite files and corrupt the **Master Boot Record (MBR)**, rendering machines unusable; some analyses also noted a built-in kill timer and development artifacts linked to the name “Shamoon.” Later reporting said the malware resurfaced after its initial 2012 attacks, reinforcing its reputation as an effective if relatively unsophisticated wiper built for high-impact sabotage against enterprise IT networks.
Jun 29, 2026
Palo Alto Networks Unit 42 reported a second wave of **Shamoon 2** attacks, a destructive malware campaign that targeted organizations in the Middle East and used disk-wiping functionality to disrupt operations. The activity followed the re-emergence of the Shamoon malware family and reflected a renewed effort to damage systems rather than steal data, with infected machines rendered unusable after the malware overwrote critical files and the master boot record. The report identified the campaign as part of the broader **Shamoon 2** resurgence, indicating that attackers continued to refine and redeploy the wiper against regional targets after the initial incidents. For defenders, the attacks underscored the risk posed by destructive malware in enterprise environments, particularly where lateral movement and insufficient segmentation can allow a wiper to spread quickly and cause widespread operational outages.
Jul 12, 2026
Palo Alto Networks Unit 42 reported that **Shamoon 3** resurfaced as a destructive malware campaign using a modified open-source wiper, continuing the lineage of the Shamoon attacks that targeted organizations in the Middle East. The malware was designed to overwrite files and disrupt operations, indicating an intent to cause large-scale system damage rather than conduct espionage or financially motivated crime. Researchers said the updated wiper included a verse from the Quran embedded in the malware, a notable artifact in the sample’s construction, while its use of altered open-source code highlighted how destructive tooling can be rebuilt from publicly available components. The findings underscored that Shamoon remained an active threat capable of being adapted for renewed disruptive attacks against enterprise environments.
Jul 12, 2026