INCIDENT FILE / 16

2012-08-15 · Energy / Saudi Arabia

Shamoon / Saudi Aramco

The malware wiped workstation data and disrupted a large part of the business network while production systems remained isolated.

01

Attack path

The initial entry vector was not officially resolved; the malware propagated inside the business environment through network shares.

02

Confirmed impact

The malware wiped workstation data and disrupted a large part of the business network while production systems remained isolated.

03

Response

Network isolation, workstation rebuilding and stronger separation between business and operational environments.