The upcoming winter holidays bright forth not only new cyber threats but also old malware pieces. That’s exactly the case with Shamoon malware which has apparently returned to the malware scene after a four year vacation. Reports from security companies Symantec and Palo Alto reveal details about its resurrection.
Shamoon Targets Saudi Companies Once Again
Shamoon, a.k.a. Disstrack was initially detected about four years ago in attacks against Saudi Oil Company Aramco. Its intention was to wipe thousands of computers.
This time around, the malware is targeting another Saudi organization, which hasn’t been revealed yet. And its agenda is not just wiping companies’ machines but also overwriting their Master Boot Records with the image of Aylan Kurdi’s corpse. The attack took place on November 17 which is a Muslim holiday. The attackers most likely chose that date to bypass security measures.
Related: How Easy It Is To Hack an Organization
Apparently, Shamoon had a list of hardcoded logins, which allowed the malware to perform its malicious activities quicker. This also means that the targeted company had already been breached. According to Palo Alto, the attackers could be the same ones from Shamoon’s initial campaigns four years ago.
“The current attack campaign has several TTP overlaps with the original Shamoon campaign, especially from a targeting and timing perspective.”
“Disttrack malware used in the recent attacks is very similar to the variant used in the 2012 attacks, which uses the exact same RawDisk device driver as well.”
Shamoon/ Disttrack Malware Technical Overview
Palo Alto explains that the malware is comprised of three distinct parts:
- Dropper;
- Communications;
- Wiper components.
Related: Privileged Users Are the Riskiest in an Organization, Security Survey Says
The main executable is a dropper deployed to extract additional tools from embedded resources. It’s also used to coordinate when to save and execute them.
Embedded within each Disttrack sample is a component responsible for communicating with a C2 server and a separate component used to carry out the wiping functionality.
The malware’s main purpose is data destruction, thus attempting to damage as many systems as possible. That’s why it tries to spread to other systems on the network via stolen admin credentials. As pointed out by the researchers, this is a tactic quite similar to the one deployed in the 2012 attacks.
Disttrack/ Shamoon is also capable of downloading and executing additional apps to targeted systems, and remotely setting the date to start wiping systems.
Why Are Attackers Using Wiper Malware?
The purpose of this type of malware is, obviously, not financial gain. These types of attacks are mainly deployed to cause chaos in an organization, and could be linked to hacktivist groups or politically-engaged attackers. They could also be used to destroy evidence or cover tracks of data exfiltration.
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: