Article
APT33/Peach Sandstorm: Threat Forecast and Analysis of a Cloud-Focused Adversary
APT33 (Elfin, Peach Sandstorm) 2025 forecast: its cloud-first attack model, password spraying, Azure C2 abuse, TTPs, IoCs and defense guidance.
Read more
Significant cyber incident
Shamoon wiper attack on Saudi Aramco
On 15 August 2012 the Shamoon wiper virus hit workstations at Saudi Aramco, the Saudi national oil company.
In short
On 15 August 2012 the Shamoon wiper virus hit workstations at Saudi Aramco, the Saudi national oil company. About 30,000 computers were damaged and the main internal network was shut for more than a week. Aramco and the Saudi Interior Ministry said the aim was to stop oil and gas production, but production was not affected. The Interior Ministry said an organized foreign group was behind it but did not name it.
What happened
On 15 August 2012 a computer virus known as Shamoon infected workstations at Saudi Aramco. The company shut down its main internal network for more than a week. Shamoon wiped the hard drives of the computers it reached.
The US Congressional Research Service says the attacks compromised 30,000 computers and that the code was apparently designed to disrupt or halt oil production. On 9 December 2012 Aramco said about 30,000 computers were damaged and that the aim was to stop the flow of oil and gas. Aramco said production was not disrupted and that damage was limited to office computers.
The same attacks also hit the Qatari gas producer RasGas, according to a report on a Saudi Interior Ministry statement. The Ministry said its investigation concluded that an organized foreign group was behind the attacks and that Aramco employees were not involved. Sources differ on who was responsible: see the attribution note.
Timeline
-
2012
MITRE ATT&CK says Shamoon was first used in 2012 by an Iranian group known as the "Cutting Sword of Justice".
-
15 August 2012
Shamoon infects workstations at Saudi Aramco; the company shuts down its main internal network for more than a week.
-
August 2012
The same attacks hit the Qatari gas producer RasGas, according to NBC News.
-
9 December 2012
Aramco's vice president for corporate planning says the main target was to stop the flow of oil and gas, and that the attackers did not achieve it.
-
9 December 2012
The Saudi Interior Ministry says an organized foreign group was behind the attacks and that Aramco employees were not involved; it does not name the group.
-
2016
MITRE ATT&CK records a second version, known as Shamoon 2.
-
2018
MITRE ATT&CK records a third version, known as Shamoon 3.
How the attack worked
No public Saudi or US government account of the first intrusion route was found among the pages we opened, so how the attackers got in is not stated here. The description below comes from MITRE ATT&CK’s entry on the Shamoon malware and from the statements reported by NBC News.
Spreading across the network
NBC News reports that Shamoon spreads through networked computers and overwrites files. MITRE says it scans the C-class subnet of the IP addresses on the victim’s interfaces, accesses network shares and copies itself to remote machines (Remote Services: SMB/Windows Admin Shares, T1021.002; Lateral Tool Transfer, T1570). It creates a service named “ntssrv” to run its payload (System Services: Service Execution, T1569.002). If it cannot access shares with current privileges, MITRE says it tries hard coded domain credentials gathered earlier in the intrusion (Valid Accounts: Domain Accounts, T1078.002).
Waiting for a set date
MITRE says Shamoon reads the system time and only activates if it is later than a preset date (System Time Discovery, T1124).
Wiping and rebooting
MITRE says Shamoon overwrites parts of the disk structure such as the master boot record (Disk Wipe: Disk Structure Wipe, T1561.002), has been seen using the RawDisk and Filerase tools for wiping, and reboots the system when wiping is complete (System Shutdown/Reboot, T1529). NBC News reports that it wiped computers’ hard drives clean.
- SpreadCopies itself over network shares to other computersTechnique T1021.002 (MITRE ATT&CK, opens in a new tab)
- ExecuteRuns through a service named ntssrvTechnique T1569.002 (MITRE ATT&CK, opens in a new tab)
- WaitActivates only after a preset dateTechnique T1124 (MITRE ATT&CK, opens in a new tab)
- WipeOverwrites the disk structure and dataTechnique T1561.002 (MITRE ATT&CK, opens in a new tab)
- RebootRestarts the wiped computerTechnique T1529 (MITRE ATT&CK, opens in a new tab)
ATT&CK techniques
- Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Who says who was behind it
Sources differ on who was responsible. MITRE ATT&CK says Shamoon was first used in 2012 by an Iranian group known as the "Cutting Sword of Justice". The US Congressional Research Service says some security officials have suggested that Iran may have supported the attack, and that numerous groups, some with links to nations with objectives counter to Saudi Arabia, claimed credit. The Saudi Interior Ministry said on 9 December 2012 that an organized foreign group was behind the attacks and did not name the group or say where it was based. No court or government finding is cited here.
Impact
About 30,000 computers were compromised, according to the Congressional Research Service and Aramco as reported by NBC News. Aramco shut down its main internal network for more than a week. Aramco said oil production was not disrupted and that damage was limited to office computers and did not affect systems software that might hurt technical operations. NBC News describes it as one of the most destructive cyber strikes conducted against a single business. The attacks also hit RasGas in Qatar. No financial loss figure was found in the sources opened.
Government and regulator response
- August 2012: Aramco shut down its main internal network for more than a week (NBC News, 9 December 2012).
- 9 December 2012: Aramco and the Saudi Interior Ministry were conducting an investigation (NBC News).
- 9 December 2012: the Interior Ministry said its investigation had not shown any involvement of Aramco employees and that an organized foreign group was behind the attacks (NBC News).
- No Saudi regulator action or sanction is described in the sources opened. The National Cybersecurity Authority was established in 2017, after this incident.
Lessons
-
Office networks can be a path to disruption
Aramco said damage was limited to office computers, yet the main internal network was down for over a week. Plan for losing the office network.
-
Wipers need offline recovery
Shamoon wiped hard drives clean. Keep tested backups and rebuild images that the attack cannot reach.
-
Isolation limited the harm
Aramco said the attack did not affect systems software that might hurt technical operations. Keeping office and operational networks apart reduced the damage.
-
Time-triggered malware sits quietly first
MITRE says Shamoon only activates after a preset date. Long dwell time before a trigger is possible, so hunt for lateral movement early.
-
Shared credentials spread the damage
MITRE says Shamoon tries hard coded domain credentials gathered earlier. Limit admin rights and rotate credentials after any suspected intrusion.
-
Attribution takes time and stays uncertain
Sources differ on who was behind it. Plan the response without waiting for a name.
What to check in your own organization
-
Can you rebuild 30,000 machines?
Estimate how long it would take to re-image your fleet from clean media and who would do it.
-
Are backups offline and tested?
Check that at least one copy cannot be reached from the domain and that you have restored from it recently.
-
Is the office network separated from operations?
Check firewalls and jump hosts between office IT and industrial or production systems.
-
Who can use admin shares?
Review which accounts can reach remote administration shares on many machines and remove broad access.
-
Are service creations and scheduled tasks monitored?
Alert on new services and tasks created remotely on servers and workstations.
-
Would you notice a wiper in progress?
Check that endpoint tools alert on mass file overwrites and changes to the disk boot record.
-
Do you have a comms plan without email?
If the internal network is down for a week, how do staff and partners get updates?
Where it happened
- Industry Energy and utilities Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
- Country Saudi Arabia Saudi Arabia is a Gulf state whose energy, aviation, government and telecommunications sectors have been named by official sources as targets of Iran-linked and other state-linked groups. Middle East
Questions
What was Shamoon?
MITRE ATT&CK describes it as wiper malware first used in 2012. It overwrites data and disk structures so computers cannot start.
When did it hit Saudi Aramco?
Workstations were infected on 15 August 2012, according to NBC News.
How many computers were affected?
The Congressional Research Service says 30,000. Aramco said about 30,000 computers were damaged, as reported by NBC News.
Did it stop oil production?
Aramco said it failed to disrupt production, according to NBC News.
Who was behind it?
Sources differ. MITRE points to an Iranian group; the Congressional Research Service says some officials suggested Iranian support; the Saudi Interior Ministry said an organized foreign group and named none.
Did Shamoon return?
MITRE ATT&CK says versions known as Shamoon 2 and Shamoon 3 were observed in 2016 and 2018.
In our research
- APT33/Peach Sandstorm: Threat Forecast and Analysis of a Cloud-Focused Adversary November 2025
- Wiper malware Glossary term
Sources
- Shamoon, Software S0140 MITRE ATT&CK
- Cyberwarfare and Cyberterrorism: In Brief (R43955) Congressional Research Service
- Saudi Arabia says cyber attack aimed to disrupt oil, gas flow (9 December 2012) NBC News
- Saudi says foreign group behind cyber-attacks (9 December 2012) NBC News
- Laws and Regulations (National Cybersecurity Authority established 2017) National Cybersecurity Authority
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.