Rewterz Threat Alert – Shamoon 2: Disttrack Wiper Returns

Severity

High

Analysis Summary

Shamoon 2 returns with overlapping attack activity that is indicative of ITG013 (also known as “APT34” or “Oilrig”) and an unknown, probably Iranian cyber group targeting the energy sector in the Middle East. Further, it is assessed that access to at least one targeted environment was used to conduct a destructive attack using newly identified disk wiper malware, ZeroCleare. The attack timeline may have begun as early as Autumn of 2018 with reconnaissance scanning from various low cost/free VPN providers and gaining access to one of the accounts that was later involved in the attack. Then, in the Summer of 2019, the attackers used a password spray from a system on the local network to gain access to additional accounts, install ASPX webshells, and gain domain administration privileges. Finally, unknown actors spread a destructive wiper X-Force IRIS has named “ZeroCleare” across the target network and executed it. The ZeroCleare disk wiper malware had both x86 and x64 versions to execute across 32-bit and 64-bit operating systems. Interestingly, this malware incorporated the Eldos RawDisk driver, which was previously used in each of the Shamoon attacks.

Impact

Data destruction

Indicators of Compromise

MD5

• 33f98b613b331b49e272512274669844
• 69b0cec55e4df899e649fa00c2979661
• 1a69a02b0cd10b1764521fec4b7376c9
• 993e9cb95301126debdea7dd66b9e121
• 1ef610b1f9646063f96ad880aad9569d
• eaea9ccb40c82af8f3867cd0f4dd5e9d

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders .