> series: anatomy_of_a_breach —— part: 044 —— target: saudi_aramco —— workstations_wiped: 30,000 —— purpose: destruction<span class="cursor-blink">_</span>_
On 15 August 2012 — the eve of one of Saudi Arabia's holiest nights, Lailat al Qadr, when most employees were off work — a destructive wiper malware known as Shamoon activated on approximately 30,000 workstations across Saudi Aramco's corporate network. The malware overwrote the master boot record of each infected machine with an image of a burning American flag, then wiped all data from the hard drive, rendering every affected workstation inoperable.
Saudi Aramco — the world's most valuable company, responsible for approximately 10% of global oil production — was forced to operate on paper for weeks while it replaced 30,000 hard drives. The company reportedly bought such a large proportion of the world's available hard drive supply that it temporarily affected global hard drive prices. The attack was attributed to Iranian state-sponsored actors and was widely interpreted as retaliation for the Stuxnet attack on Iran's nuclear programme. A group calling itself the 'Cutting Sword of Justice' claimed responsibility.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallUnlike Stuxnet (which targeted specific industrial equipment) or Flame (which gathered intelligence covertly), Shamoon was designed purely for destruction. Its architecture was straightforward: a dropper component that established the malware on the system, a wiper component that overwrote data and master boot records at a predetermined time, and a reporting component that communicated successful destruction back to the attackers. The timing — triggered during a holiday period when minimal staff were present — maximised the damage and minimised the chance of early detection.
Wiper attacks cannot be 'paid off' like ransomware — the data is destroyed, not encrypted. The only defence is prevention (stopping the malware from executing) and resilience (the ability to restore operations from backups). This requires immutable, offline backups that are regularly tested, network segmentation that limits the blast radius, endpoint detection that identifies wiper deployment before activation, and incident response plans that have been rehearsed.
Our infrastructure penetration testing assesses backup integrity, network segmentation, and endpoint security controls. Cyber Essentials mandates backup and recovery controls. SOC in a Box provides the 24/7 monitoring that detects wiper deployment — the anomalous file system activity, MBR modification attempts, and mass deletion patterns that precede a wiper activation. And UK Cyber Defence provides the incident response capability to manage the crisis when a destructive attack occurs.
Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> validates your backup integrity and recovery procedures. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects wiper deployment before activation. Because when 30,000 workstations are destroyed, only tested backups and practised recovery plans make the difference.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call