A variant of the Shamoon malware that hit Saudi Aramco’s servers six years
ago is back, Axios reports,
citing a release from the cybersecurity unit of Alphabet, Chronicle.
According to the Chronicle release, the company had detected a file infected
with Shamoon in its database VirusTotal.
The malware, Chronicle said, was uploaded from Italy and is different from
the previous two variants. Those moved through networks via pre-programmed
credentials while this one stays on the computer it is installed on first.
There is no command and control infrastructure that would allow the attackers
to communicate with the virus, and what the virus does this time is encrypt
all files irreversibly rather than replacing them with politically
significant images, Axios reports.
While the cybersecurity experts at Chronicle figure out what the malware
is all about this time, they do note it comes on the heels of a report from
Italy’s oilfield services major Saipem that it had become the target of a
cyberattack, with the most severe blow suffered by its network in the Middle
East.
Reuters quoted
Saipem’s head of digital and innovation operations, Mauro Piasere, as saying
the company’s servers in the UAE, Saudi Arabia, and Kuwait had been affected
by malware, with the origin of the attack Chennai, India.
“The servers involved have been shut down for the time being to assess the
scale of the attack,” Piasere said.
Chronicle’s experts, for their part, said "While Chronicle cannot
directly link the new Shamoon variant to an active attack, the timing of the
malware files comes close to news of an attack on an Italian energy
corporation with assets in the Middle East."
In January 2017, Saudi Arabia issued a warning to local organizations that
the Shamoon virus that had hit state-held oil giant Saudi Aramco in 2012 has
resurfaced in a new variant. The Shamoon 2, which completely wiped out
computer disks, reportedly targeted 15 government agencies and private
organizations, state media reported at the time.
By Irina Slav for Oilprice.com
More Top Reads From Safehaven.com
