Throwback Attack: Shamoon Malware on The Saudi Aramco

The attack was started in mid-2012 when one of the IT team at Saudi Aramco, the state-owned Saudi Arabia oil company, opened a scam email and clicked on a bad link containing malware, later called Shamoon. The hackers were into their system but not immediately attacked. The actual threats began during the Islamic holy month of Ramadan when most Saudi Aramco employees were on holiday. On the morning of Wednesday, August 15, 2012, some employees noticed their computers were acting weird: screens started flickering, files began to disappear, and some computers just shut down, according to CNN Business. 

More than 30,000 workstations at the company were affected by the malware. Saudi Aramco’s computer technicians had no choice but to rip cables out of the backs of computer servers at data centres all over the world. Every office was physically unplugged from the Internet to prevent the virus from spreading further. Everything, from managing supplies, shipping, contracts with business partners to reporting were done manually with typewriters or fax machines. Not only that, Saudi Aramco bought 50,000 new hard drives to replace the infected ones.

After the attack, a group calling itself “Cutting Sword of Justice” claimed responsibility for the attack, saying they were retaliating against the Al Saud regime for its crimes against humanity. There is no ransom requested by Shamoon and it is an example of weaponised malware that is designed for use in cyber-war. 

Shamoon, known as W32.Distrack, is an aggressive, disk-wiping malware program that can wipe the master boot records and replace it with various images, such as image of a burning U.S. flag.The Shamoon malware was also used against Qatar’s RasGas oil company. After the 2012 attack, Shamoon resurfaced in 2016 and in 2018 in a new version that targets energy sector infrastructure in the Middle East.

Other Cyberattacks Cases During the Holidays

Beside Shamoon, several major cyber-threats cases during the holidays in 2021, such as: 

• The largest fuel pipeline operation company, Colonial Pipeline, was forced to pay a ransom of US$4.4 millions to the Darkside hacker group after a ransomware attack during the Mother’s Day Weekend on May 9, 2021. The attack successfully disrupted fuel deliveries in the South-East US for several days.  
• JBS, the world’s biggest meat processor, paid US$11 millions after a cyber-attack sabotaged its operations, including abattoirs in the US, Australia, and Canada during Memorial Day weekend on May 31, 2021.
• On the July 4 holiday weekend in 2021, when millions of Americans logged out to spend time with friends and family, one of the most significant ransomware attacks of the year began. It was targeted against Kaseya’s software technology which caused national railway systems, schools, broadcasters, etc. to shut operations as file-encrypting malware hit them. 
• Over the Labour Day weekend, Howard University in Washington DC was taken offline and forced to cancel classes for a week as its network was held hostage by cyber-criminals. The cyber-criminals used phishing emails to gain access to credentials from unsuspecting university network users and used the credentials to orchestrate this holiday ransomware attack. 

Cybersecurity Tips During Holiday Season

It is important to prevent cyber threats because security breaches risk financial pain, fines, and endanger your brand, reputation and customer trust in your organisation. Several best practises to reduce the risk and impact of cybersecurity attack, such as:

1. Make an offline backup of your data.

Make and maintain offline, encrypted backups of data and regularly test your backups. It is important that backups be maintained offline as many ransomware variants attempt to find and delete or encrypt accessible backups. Review your organisation’s backup schedule to take into account the risk of a possible disruption to backup processes during weekends or holidays.

2. Do not click on suspicious links.

Minimise the risk of human errors through user training programs and phishing exercises to raise awareness about the risks involved on click or opening malicious websites and attachment.