Shamoon attacks persist

While it still unknown whether the recent attacks against Saudi Aramco and RasGas were part of the so-called Shamoon attacks, the latter are continuing unabated, says Symantec.

These newest attacks also use a more recent variant of the destructive Disstrack malware.

Initially, the malware would drop a wiper component and it would first wipe a prioritized list of files contained in the Documents and Settings, Users and System32\Config folders by overwriting them with a 192KB block filled with a partial JPEG image of a burning United States flag, then the computer’s Master Boot Record and its active partition.

This new variant isn’t into making a statement, so the 192KB block that overwrites the files contains only randomly generated data.

Unfortunately, the initial infection vector has still not been confirmed, so it’s difficult to say what likely targets should be on the lookout for.

The malware can be detected by a variety of desktop AV solutions, but if you don’t have one, checking for and finding a service called ddr, a file called ddr.sys in the %System%\Drivers folder and ddrisk.sys in the %System%\Drives folder may indicate that your machine has been compromised.

Still, this is a problem that individual users are likely not to have, as the Shamoon attacks have been very limited and extremely targeted.