Scourge · August 15 2012

The Scourge of Shamoon

Chronicle

On 15 August 2012, at 11:08 Saudi time, the Shamoon (Disttrack) wiper began erasing the disks of about 30,000 Saudi Aramco workstations, replacing files with an image of a burning American flag. A group calling itself the 'Cutting Sword of Justice' claimed responsibility. The oil production networks were separate and untouched, but the company spent weeks rebuilding its IT.

Lesson learned

It was the first big wiper against an energy company and taught that isolating operational networks saves production, while backups save everything else.

Prayer of reparation

O Shamoon, who burned flags on other people's disks, keep your fire away from our master boot records and leave us at least the backup. Amen.

How it is remembered

Remembered by keeping production networks separate, holding offline backups and knowing how many workstations you can rebuild in a day.