{"id":93157,"date":"2018-12-14T12:32:41","date_gmt":"2018-12-14T20:32:41","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=93157"},"modified":"2024-02-19T23:01:58","modified_gmt":"2024-02-20T07:01:58","slug":"shamoon-returns-to-wipe-systems-in-middle-east-europe","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shamoon-returns-to-wipe-systems-in-middle-east-europe\/","title":{"rendered":"Shamoon Returns to Wipe Systems in Middle East, Europe"},"content":{"rendered":"

Destructive malware has been employed by adversaries for years. Usually such attacks are carefully targeted and can be motivated by ideology, politics, or even financial aims.<\/p>\n

Destructive attacks have a critical impact on businesses, causing the loss of data or crippling business operations. When a company is impacted, the damage can be significant. Restoration can take weeks or months, while resulting in unprofitability and diminished reputation.<\/p>\n

Recent attacks have demonstrated how big the damage can be. Last year NotPetya affected several companies around the world. Last February, researchers uncovered OlympicDestroyer, which affected the Olympic Games organization.<\/p>\n

Shamoon is destructive malware that McAfee has been monitoring since its appearance. The most recent wave struck early this month when the McAfee Foundstone Emergency Incident Response team reacted to a customer\u2019s breach and identified the latest variant. Shamoon hit oil and gas companies in the Middle East in 2012 and resurfaced in 2016 targeting the same industry. This threat is critical for businesses; we recommend taking appropriate actions to defend your organizations.<\/p>\n

During the past week, we have observed a new variant attacking several sectors, including oil, gas, energy, telecom, and government organizations in the Middle East and southern Europe.<\/p>\n

Similar to the previous wave, Shamoon Version 3 uses several mechanisms as evasion techniques to bypass security as well to circumvent analysis and achieve its ends. However, its overall behavior remains the same as in previous versions, rendering detection straightforward for most antimalware engines.<\/p>\n

As in previous variants, Shamoon Version 3 installs a malicious service that runs the wiper component. Once the wiper is running, it overwrites all files with random rubbish and triggers a reboot, resulting in a \u201cblue screen of death\u201d or a driver error and making the system inoperable. The variant can also enumerate the local network, but in this case does nothing with that information. This variant has some bugs, suggesting the possibility that this version is a beta or test phase.<\/p>\n

The main differences from earlier versions are the name list used to drop the malicious file and the fabricated service name MaintenaceSrv (with \u201cmaintenance\u201d misspelled). The wiping component has also been designed to target all files on the system with these options:<\/p>\n