WiperATT&CK S0140
Shamoon
Also known as: Disttrack
Shamoon, also called Disttrack, is destructive malware first reported in 2012 attacks on energy-sector organisations in the Middle East. A new version, often called Shamoon 2, was used in waves of attacks on organisations in Saudi Arabia from late 2016. It overwrites disk structures and files so that machines cannot boot.
- Public attribution and associated actors
- The cited sources do not make a government attribution; this page makes none.
- First seen
- 2012
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0140 Shamoon
How it spreads or gets in
- Spread across networks using stolen domain credentials and administrative shares, with execution through services and scheduled tasks.
Key behaviours
- Overwrote the master boot record, partition tables and files.
- Was set to trigger at a specific date and time for maximum disruption.
- Reported back to a command server about the hosts it destroyed.
ATT&CK techniques
- T1078.002Valid Accounts: Domain Accounts
- T1021.002Remote Services: SMB/Windows Admin Shares
- T1053.005Scheduled Task/Job: Scheduled Task
- T1543.003Create or Modify System Process: Windows Service
- T1485Data Destruction
- T1561.002Disk Wipe: Disk Structure Wipe
- T1529System Shutdown/Reboot
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Alert on services created remotely on many hosts at once.
- Detect raw disk access by unexpected processes.
- Watch privileged domain accounts for use outside normal patterns.
Defences that work
- Use tiered administration and limit where domain admin accounts can log on.
- Segment networks so administrative protocols are not open between all hosts.
- Keep offline backups and gold images so fleets can be rebuilt.