Return of Shamoon
- Event Year
- 2016
- Reliability
- Confirmed
- Country
- Saudi Arabia
- Industry
- Petroleum
- Attack Type
- Targeted Attack
Description
Beginning November 2016 a new Shamoon variant (Shamoon 2) wiped systems at multiple Saudi government and private-sector organisations, including the General Authority of Civil Aviation. The new version added tooling to harvest credentials and a configurable wipe schedule, allowing time-coordinated detonation across networks.
Impact
Thousands of corporate workstations were wiped at multiple targets. GACA disclosed that flight schedules and ground operations were unaffected because critical aviation systems were segmented from the impacted IT networks.
Sources
- History of Industrial Control System Cyber Incidents - Idaho National Laboratory
Source list compiled from OTCAD (Stash Kempinski / Secura, GPL-3.0). Description is risidata's own prose.