A version of Shamoon, the destructive computer virus that crippled tens of thousands of computers at Middle Eastern energy companies four years ago, was used in mid-November to attack computers in Saudi Arabia and elsewhere in the region, according to US security firms.
CrowdStrike, Palo Alto Networks and Symantec warned of the new attacks on Wednesday. They did not name any victims of the new version of Shamoon, which cripples computers by wiping their master boot records that they use to start up. They also did not say how much damage had been caused or identify the hackers.
FireEye said in a blogpost that its Mandiant unit "has responded to multiple incidents at other organisations in the region". A spokesperson declined to identify the countries or organisations.
The reappearance of Shamoon is significant as there have only been a handful of other high-profile attacks involving disk-wiping malware, including ones in 2014 on Sheldon Adelson’s Las Vegas Sands and Sony’s Hollywood studio.
Governments and businesses pay close attention to such cases because it can be time-consuming and extremely expensive to restore infected systems.
The original Shamoon hackers left images of a burning US flag on machines at Saudi Aramco and RasGas in 2012.
Researchers said the Shamoon 2 hackers left a calling card: a disturbing image of the body of three-year-old Syrian refugee Alan Kurdi, who drowned in the Mediterranean last year.
The FireEye spokesperson said the malware contains embedded credentials, which suggests the attackers may have previously conducted intrusions to gather the necessary logins and passwords before later embedding them into the malware for the destructive attack.
The 2012 Shamoon attacks were probably conducted by hackers working on behalf of the Iranian government, said CrowdStrike chief technology officer Dmitri Alperovitch. It is too early to say whether the same group was behind Shamoon 2, he said.
The motive of the recent attacks was also not immediately clear.
"Why Shamoon has suddenly returned ... after four years is unknown," the Symantec Security Response team said on its blog. "However, with its highly destructive payload, it is clear that the attackers want their targets to sit up and take notice."
The malware triggered the disk-wiping to begin at 8.45pm local time on Thursday, November 17, according to the security firms.
The Saudi business week ends on Thursday, so it appears to have been timed to begin after staff left for the weekend, to reduce the chance of discovery and allow maximum damage.
"The malware had, potentially, the entire weekend to spread," Palo Alto researcher Robert Falcone said in a blog post.