Enlargereader comments 5
Share this story
A new variant of Shamoon, the malware that wiped hard drives at Saudi Aramco and other energy companies in 2012, has struck multiple organizations in Saudi Arabia in a new campaign that researchers call a “carefully planned operation.” The new variant, which is almost identical to the version used in the 2012 attacks, has replaced the message it previously displayed—which included an image of a burning American flag—with the photo of the body of Alan Kurdi, the 3-year-old Syrian refugee boy who drowned as his family tried to cross from Turkey to Greece.
Bloomberg reports that digital forensics by Saudi officials indicated that the attacks were launched from Iran.
Several Saudi government agencies were among the organizations attacked.
New versions of Shamoon, also known as Disttrack, have been detected by multiple information security companies, including McAfee, Symantec, Palo Alto Networks, and FireEye.
It isn’t yet clear how the malware’s “dropper” has gotten into the networks it has attacked.
But once on a victim’s Windows system, it determines whether to install a 32-bit or 64-bit version of the malware.
According to a report from Symantec, the latest Shamoon attack was configured to automatically start wiping the disk drives of computers it had infected at 8:45am local time on November 17.
The wiper malware itself uses RawDisk, a commercial software driver from EldoS that gives direct access to the disk drives of the infected system to write data—or in this case, overwrite data.
The same driver was used in the “wiper” attacks against Sony Pictures in 2014.
Before beginning the wipe, the malware sets the system clock of the infected computer back to a random date in August of 2012, according to a report from FireEye—likely to bypass code in the EldoS driver from checking for a valid license. “Analysis suggests this might be for the purposes of ensuring the [EldoS driver] that wipes the Master Boot Record (MBR) and Volume Boot Record (VBR) is within its test license validity period,” the FireEye research team wrote.
The new Shamoon variant attempts to spread across the network by turning on file sharing and attempting to connect to common network file shares, and it disables user access controls for remote control sessions with a Windows Registry change.
The malware attempts to connect to ADMIN$, C$\Windows, D$\Windows, and E$\Windows shares on the target systems with the local user’s current privileges first.
If they aren’t enough to gain access to those shares, it starts trying stolen credentials—credentials that have been hard-coded into the malware samples, indicating that the attackers had previously managed to penetrate the targeted networks and harvest user credentials for Windows domain administrators and other high-level accounts. When it finds these shares available, it copies itself into the Windows directory of the other system.
While these latest malware attacks have included code to communicate with a command-and-control system, the attackers apparently disabled the code, leaving it pointed at a nonexistent server.
There was clearly no desire to exfiltrate information—though information may well have already been stolen before Shamoon was activated, and the disk wiper may have been left as a parting gift by the attackers.