In 2016-17, a variant known as Shamoon 2 re-emerged, deleting data across dozens of Saudi public and private sector networks.

Key facts

• Active in 2016-17 as a return of the Shamoon wiper.
• Hit numerous Saudi government and private organisations.
• Continued the pattern of destructive, disruption-focused attacks.
• Reinforced the persistent regional wiper threat.

The lesson

Shamoon 2 showed destructive malware families return and evolve. Organisations in targeted regions must assume recurrence and prepare accordingly.

How DarkThreatX helps

DarkThreatX monitors the dark web for breached records, leaked credentials and threat-actor activity tied to your organisation. Run a free dark web scan or explore the platform.