Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware

When discussing suspected Middle Eastern hacker groups with destructive capabilities, many automatically think of the suspected Iranian group that previously used SHAMOON – aka Disttrack – to target organizations in the Persian Gulf. However, over the past few years, we have been tracking a...

Shamoon Collaborator Greenbug Adopts New Communication Tool

Researchers have identified a possible new collaborator in the continued Shamoon attacks against Saudi organizations. Called Greenbug, this group is believed to be instrumental in helping Shamoon steal user credentials of targets ahead of Shamoon’s destructive attacks. However, researchers know...

New Clues Surface on Shamoon 2's Destructive Behavior

Researchers on Monday reported progress in piecing together some of the missing pieces of the Shamoon 2 puzzle that have been eluding them when it comes to lateral network movement and execution of the Disttrack malware component used in past campaigns. Shamoon 2 uses a combination of legitimate...

StoneDrill Disk Wiping Malware Found Targeting European Industries

A new disk wiping malware has been uncovered targeting a petroleum company in Europe, which is quite similar to the mysterious disk wiper malware Shamoon that wiped data from 35,000 computers at Saudi Arabia's national oil company in 2012. Disk wiping malware has the ability to cripple any...

Destructive StoneDrill Wiper Malware On The Loose

There have been a handful of wiper malware attacks in the wild in the last decade with Shamoon’s destruction of more than 35,000 workstations at Saudi Aramco in 2012 and the Dark Seoul attacks on Sony Pictures Entertainment the most high profile. However, since last fall, Shamoon has resurfaced...

FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region

In 2012, a suspected Iranian hacker group called the “Cutting Sword of Justice” used malware known as Shamoon – or Disttrack. In mid-November, Mandiant, a FireEye company, responded to the first Shamoon 2.0 incident against an organization located in the Gulf states. Since then, Mandiant has...

FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region

In 2012, a suspected Iranian hacker group called the “Cutting Sword of Justice” used malware known as Shamoon – or Disttrack. In mid-November, Mandiant, a FireEye company, responded to the first Shamoon 2.0 incident against an organization located in the Gulf states. Since then, Mandiant has...

Destover Wiper Malware Analysis

Researchers are starting to stitch together clues about the wiper malware that has landed a body blow to Sony Pictures Entertainment. Not only were thousands of files and documents leaked that included unreleased movies, confidential company presentations and financial records, employee records,...

FBI Flash Warning Alerts Businesses to Wiper Malware Attacks

The FBI issued a five-page flash warning yesterday urging American enterprises to be on the lookout for wiper malware. The alert, a Reuters report said, described some details about the malware but kept the victim anonymous. It’s general practice for the FBI not to name victims in such alerts. Th...

ICS-CERT Tips for Critical Infrastructure to Avoid Shamoon

Most publicly known malware attacks are disruptive in nature, for example causing the interruption of online banking services or taking websites temporarily offline. Few attacks cause actual physical damage to computers where hard drives are damaged and data lost or destroyed. The Shamoon virus i...

2012: What Have We Learned

There’s a natural inclination for people at the end of each year to look back, take stock and try to draw some grand meaning or life lessons out of the events of the past 12 months. This is a particularly risky and difficult thing to do in the security industry, given its inherent unpredictabilit...

Iran Retracts Reports of New Stuxnet-Like Attacks Against Utilities

Iranian officials are retracting Christmas day reports that malware resembling Stuxnet had been used to attack manufacturing facilities including a power utility in southern Iran. Ali Akbar Akhavan, head of Iran’s Passive Defense Organization, was quoted in reports yesterday by the Iranian...

Iran CERT Reports New Data-Wiping Malware

Computer systems in Iran are being targeted by a new strain of malware that is capable of wiping disk partitions clean of files. Security researchers are calling the attacks simplistic, yet effective. Researchers at Kaspersky Lab said the malware launches only on pre-determined dates and will...

Aramco cyber attacks intends to stop oil production

Saudi Arabia's national oil company "Aramco" is the country's largest oil production facility and is a significant exporter in the Organization of the Petroleum Exporting Countries. They said that a cyber attack against it in August which damaged some 30,000 computers was aimed at stopping oil an...

Aramco cyber attacks intends to stop oil production

Saudi Arabia's national oil company "Aramco" is the country’s largest oil production facility and is a significant exporter in the Organization of the Petroleum Exporting Countries. They said that a cyber attack against it in August which damaged some 30,000 computers was aimed at stopping oil an...

US authorities : Iranian Hackers are Becoming a Real Pain

The U.S. have admitted they believe a series of cyber attacks on domestic banks and some foreign oil companies carried out over the last year are the handy work of a group of hackers linked to the Iranian government. Defence Secretary Leon Panetta said the cyberthreat from Iran has grown, and...

Research Paints Shamoon Creators as 'Skillful Amateurs'

Despite seemingly endless pontification, it’s still too early to definitively say whether there’s a connection between the Shamoon malware and recent attacks on Middle Eastern oil firms, yet some of the attackers’ intentions may be getting clearer. Research suggests the creators behind the recent...

Saudi Aramco Confirms Scope of Malware Attack

Officials at oil giant Saudi Aramco have confirmed that about 30,000 of the company’s workstations were hit by a malware attack on August 15, a number that lines up with claims made in posts on Pastebin by a group taking credit for the attack. The company said that while tens of thousands of...

Power Plants Are Vulnerable To Hackers with Siemens flaw

The U.S. Department of Homeland Security has issued an alert warning that hackers could exploit code in Siemens-owned technology to attack power plants and other national critical infrastructure. Justin W. Clarke, an expert in securing industrial control systems, disclosed at a conference in Los...

Aramco Threatened With New Attack

Attackers are threatening to launch a second assault on Saudi Aramco on Saturday in order to prove its abilities and the fact that it’s not relying on help from an Aramco insider. The first attack on the oil company occurred last week and resulted in the company taking its Web sites offline, sayi...