Aramco hit by Shamoon

On August 15, 2012, the Shamoon (Disttrack) wiper destroyed data on roughly 30,000 workstations at Saudi Aramco, replacing the master boot records with a burning-American-flag image. The attack — claimed by a group calling itself the Cutting Sword of Justice and widely attributed to Iranian-aligned actors — did not affect production-control systems but forced Aramco to operate manually for weeks.

About 30,000 corporate workstations rendered inoperable. Aramco kept oil production running on isolated control networks but reverted to manual processes for procurement, payments, and shipping logistics; full corporate-IT recovery took roughly two weeks.