In 2012, Iranian-backed attackers used the Shamoon wiper to destroy data across roughly 85 percent of Saudi Aramco’s Windows workstations, one of the most destructive corporate cyberattacks ever.
Key facts
- Occurred in 2012, attributed to Iran-aligned actors.
- Wiped data from tens of thousands of workstations, around 85 percent of the Windows estate.
- A related variant disrupted Qatar’s RasGas.
- Aramco reportedly bought large volumes of hard drives to recover.
The lesson
Shamoon proved cyberattacks can cause physical-scale operational damage. Destructive threats demand resilience, segmentation and early intrusion detection.
How DarkThreatX helps
DarkThreatX monitors the dark web for breached records, leaked credentials and threat-actor activity tied to your organisation. Run a free dark web scan or explore the platform.
