incident · 1344988800000

Shamoon Malware Attack on Saudi Aramco

A destructive malware attack dubbed Shamoon wiped data from approximately 30,000 to 35,000 computers at Saudi Aramco, significantly disrupting operations at the world's largest oil producer.

What happened

On August 15, 2012, attackers deployed the Shamoon wiper malware against the corporate network of Saudi Aramco. The malware overwrote the master boot record (MBR) and data on approximately 35,000 workstations, rendering them unbootable and displaying an image of a burning U.S. flag. The attack forced the company to disconnect its internal networks from the internet and replace tens of thousands of hard drives.

Technical mechanism

Shamoon (also known as Disttrack) was a modular wiper malware that used a signed commercial driver (RawDisk) for direct disk access. It spread laterally across the network using stolen credentials, overwrote files and the MBR, and reported back to a command-and-control server before rendering the system unusable.

Why it matters

The Shamoon attack demonstrated the devastating potential of destructive wiper malware used in geopolitical conflict, serving as a landmark event in the evolution of nation-state cyber operations and critical infrastructure targeting.

Impact

The attack destroyed data on tens of thousands of workstations, causing severe operational disruption for weeks. Saudi Aramco had to resort to manual processes, disconnect systems, and rapidly procure new hard drives from global suppliers.

Response

Saudi Aramco isolated its systems, engaged incident response teams, and rebuilt its IT infrastructure. A group calling itself the 'Cutting Sword of Justice' claimed responsibility. The U.S. government attributed the attack to Iran.

Defensive lessons

  • Network segmentation between IT and OT environments is critical to prevent IT-focused malware from affecting physical operations.
  • Rapid, isolated backups and offline recovery plans are essential for surviving destructive wiper attacks.
  • Privileged access management is necessary to prevent lateral movement of malware.

Evidence register

  1. Council on Foreign Relations — Compromise of Saudi Aramco and RasGas (verified)
  2. IBM X-Force IRIS — The full Shamoon: how the devastating malware was inserted into networks (verified)
  3. Congressional Research Service — Cybersecurity: Selected Cyberattacks, 2012-2025 (verified)