In 2019-20, an Iran-linked data wiper known as DUSTMAN struck Bahrain’s national oil company, Bapco, using the same disk-access driver seen in Shamoon.

Key facts

• Occurred around 2019-20 against Bahrain’s Bapco.
• Attributed to Iran-linked actors.
• Used the EldoS RawDisk driver, also leveraged by Shamoon.
• Part of a sustained regional campaign of destructive attacks on energy firms.

The lesson

DUSTMAN confirms a continuing destructive threat to Gulf energy infrastructure. Detecting intrusions and exposed access before payloads deploy is critical.

How DarkThreatX helps

DarkThreatX monitors the dark web for breached records, leaked credentials and threat-actor activity tied to your organisation. Run a free dark web scan or explore the platform.