Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Shamoon Malware Might Be Flame Copycat

August attack on Saudi energy company likely work of "anti-tyranny" hacktivist group Cutting Sword of Justice, probably a Flame copycat, say security experts.

11 Security Sights Seen Only At Black Hat
11 Security Sights Seen Only At Black Hat
(click image for larger view and for slideshow)
Malware known as Shamoon that targeted multiple energy companies and erased the hard drives of infected computers appears to have been designed not by a nation state for the purposes of cyber attacks or espionage, but rather by a band of activists protesting the commercialization of oil reserves in some Arab countries.

That revelation was announced Wednesday by Eugene Kaspersky, chairman and CEO of Kaspersky Lab, who noted that the stop time coded into the malware matched the time mentioned in a Pastebin post by the Cutting Sword of Justice group. "We can confirm that #Shamoon kill-timer is the same (08:08 UTC) as announced in anons statement," tweeted Kaspersky.

According to the group's Pastebin post, "the destruction operations began on Wednesday, Aug 15, 2012 at 11:08 AM (Local time in Saudi Arabia) and will be completed within a few hours." The Pastebin post was uploaded that same day.

According to a blog entry posted by Dmitry Tarakanov, a security researcher at Kaspersky Lab, he found that the Shamoon malware contains a timing feature that checks for the date mentioned in the Pastebin post, thus connecting Cutting Sword of Justice to the Shamoon malware. Shamoon, "Simon" in Arabic, was named after the "string of a folder name within the malware executable," according to Seculert.

[ This now-granddaddy of hacktivist groups believes "knowledge is free". Who Is Anonymous: 10 Key Facts. ]

Here's where the date check comes into play: While the Shamoon malware dropper, or installer, is working through its infection routine, it checks to see whether the hardcoded date--noted above--has arrived or not. If the date has passed, the malware proceeds to the final stage of its infection, which involves destroying data and overwriting the PC's master boot record, thus making the machine unusable. Despite the date-check goal, "it seems that the function to check the date works incorrectly," said Tarakanov, owing to the developer having gotten a simple date-checking coding routine wrong. Still, the malware often ends up proceeding to the final stage of infection anyway.

In its initial analysis of the malware, a team from Kaspserky said that one of the malware's modules was named Wiper, which is another name for the Flame espionage malware that was used to infect PCs in numerous countries including Egypt and Iran. In addition, Shamoon appeared "to be collecting information about 'interesting' files on the infected system," and sharing it with attackers, suggesting that it, too, might have been designed for espionage purposes.

But at the time, Kaspersky noted that any direct link with Flame appeared to be tenuous at best, because Flame employed specific service names and drivers that didn't appear in Shamoon, as well as an entirely different technique for deleting data on infected hard drives "It is more likely that this is a copycat, the work of a script kiddies inspired by the story," according to the Kaspersky analysis. "Nowadays, destructive malware is rare; the main focus of cybercriminals is financial profit. Cases like the one here do not appear very often."

Building on that research, Tarakanov said Wednesday that the coding error was yet more proof that the authors of Flame and Shamoon were different. "This error indirectly confirms our initial conclusion that the Shamoon malware is not the Wiper malware that attacked Iranian systems," he said. "Wiper is presumed to be a cyber-weapon and, if so, it should have been developed by a team of professionals. But experienced programmers would hardly be expected to mess up a date comparison routine."

So, who exactly is Cutting Sword of Justice? The group's Pastebin post said they're "an anti-oppression hacker group that have been fed up of crimes and atrocities taking place in various countries around the world, especially in the neighboring countries such as Syria, Bahrain, Yemen, Lebanon, Egypt," and singled out the ruling Al Saud regime in Saudi Arabia for corruption, financed by "Muslims (sic) oil resources."

According to the Pastebin post, the group first targeted its malware at Saudi Aramco, which is the state-owned national oil company of Saudi Arabia. "We penetrated a system of Aramco company by using the hacked systems in several countries and then sended (sic) a malicious virus to destroy thirty thousand computers networked in this company," said the hacktivist group.

Cutting Sword of Justice suggested that Shamoon wouldn't be its last malware attack. "We invite all anti-tyranny hacker groups all over the world to join this movement," it said. "We want them to support this movement by designing and performing such operations, if they are against tyranny and oppression."

Don't get tripped up by these common payment card data security mistakes: failing to vet the auditor, skipping the pre-audit assessment, losing track of your data, and seven more. Also in the new, all-digital 10 Ways To Fail A PCI Audit issue of Dark Reading: Test data security before the auditor arrives, Tim Wilson recommends. (Free registration required.)

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
Are You One COVID-19 Test Away From a Cybersecurity Disaster?
Alan Brill, Senior Managing Director, Cyber Risk Practice, Kroll,  10/21/2020
Botnet Infects Hundreds of Thousands of Websites
Robert Lemos, Contributing Writer,  10/22/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-28
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.
PUBLISHED: 2020-10-28
A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.
PUBLISHED: 2020-10-28
A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated user web interface.
PUBLISHED: 2020-10-28
A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) through the CGI file.
PUBLISHED: 2020-10-28
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 is vulnerable to the client registry privilege escalation attack. This fix also requires Server Side Upgrade due to Standalone Host Checker Client (Windows) and Windows PDC.