Shamoon 2 wiper attacks on Saudi government

Beginning on the evening of 17 November 2016, a reactivated version of the Shamoon disk-wiping malware — also known as Disttrack — tore through computers at multiple Saudi government organizations, most prominently the General Authority of Civil Aviation (GACA). The campaign, dubbed Shamoon 2, marked the return of the same malware family that had crippled Saudi Aramco in 2012.

What happened

The malware was pre-configured with a hard-coded trigger time. At 8:45 p.m. local time on 17 November, infected machines began overwriting files and then destroyed the master boot record (MBR), leaving systems unable to reboot. Where the 2012 Shamoon had drawn a burning U.S. flag, Shamoon 2 overwrote files with the photograph of Alan Kurdi, the drowned Syrian toddler whose image became a symbol of the refugee crisis — an apparent political message.

Analysts at Palo Alto Networks' Unit 42 identified at least three waves: 17 November 2016, 29 November 2016, and 23 January 2017. The attackers used legitimate domain credentials — likely harvested in earlier intrusions — to spread laterally, and a later wave specifically targeted Huawei virtual desktop infrastructure (VDI), embedding hard-coded administrator credentials to wipe even virtualized environments.

Impact

• Thousands of computers were reportedly destroyed at GACA's headquarters, with data erased and operations disrupted for several days.
• Multiple other Saudi government and civil bodies, including labour and transport-related agencies, were affected across the three waves.
• GACA publicly downplayed the impact, stating that only office administration systems — not aviation safety or air-traffic systems — were hit.
• Because Shamoon is purely destructive, there was no data exfiltration or ransom; the goal was disruption and sabotage.

Attribution

The Shamoon family is widely attributed by Western governments and researchers to Iranian state-sponsored actors, with the campaigns linked to groups tracked as APT33 and OilRig. Kaspersky's research connected the 2016–2017 waves to a parallel, more advanced wiper it named StoneDrill, concluding the two operations were aligned in interest though run by distinct actors. No individuals were ever charged.

Why it matters

Shamoon 2 confirmed that the 2012 Aramco attack was not a one-off but the opening of a sustained wiper campaign against the Gulf. It demonstrated that destructive malware could be re-weaponized years later, pre-timed to detonate en masse, and engineered to reach virtualized infrastructure — pushing Saudi Arabia to accelerate the creation of its National Cybersecurity Authority in 2017 and harden government endpoints across the kingdom.