Shamoon
Software · ATTACK:enterprise:S0140
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0140",
"title": "Shamoon",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0140",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--8901ac23-6b50-410c-b0dd-d8174a86f9b3",
"external_id": "S0140",
"domain": "enterprise",
"created": "2017-05-31T21:33:20.223Z",
"modified": "2024-11-17T16:07:44.262Z",
"version": "2.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Disttrack"
},
{
"source_name": "Unit 42 Shamoon3 2018",
"url": "https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"
},
{
"source_name": "Palo Alto Shamoon Nov 2016",
"url": "http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"
},
{
"source_name": "FireEye Shamoon Nov 2016",
"url": "https://web.archive.org/web/20210126065851/https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html"
},
{
"source_name": "Cylera Kwampirs 2022",
"url": "https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf"
},
{
"source_name": "Symantec Shamoon 2012",
"url": "https://www.symantec.com/connect/blogs/shamoon-attacks"
}
]
}Explicit source assertions (24)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0024d82d-97ea-4dc5-81a1-8738862e1f3b
Palo Alto Shamoon Nov 2016 · Unit 42 Shamoon3 2018ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10bc4c79-d47f-4d49-bc06-c65ae376a4b6
Unit 42 Shamoon3 2018 · Palo Alto Shamoon Nov 2016 · FireEye Shamoon Nov 2016 · Symantec Shamoon 2012ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--272068a3-47e3-42d6-8772-71d39c1976c3
Palo Alto Shamoon Nov 2016 · Unit 42 Shamoon3 2018ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2dfbcf5d-8563-440c-bd9c-0cfc15059bd5
Palo Alto Shamoon Nov 2016ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38ea7367-26e7-4a6a-b735-e98e3a35450a
FireEye Shamoon Nov 2016ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c630128-27ba-4c71-b09a-c9ac39e7acac
Palo Alto Shamoon Nov 2016 · McAfee Shamoon December 2018ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ded5760-4f2e-41f5-a2c5-f2b39eaf5733
Palo Alto Shamoon Nov 2016ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b4ac061-dee5-44f3-b0f5-021889eae45e
Unit 42 Shamoon3 2018 · Palo Alto Shamoon Nov 2016 · FireEye Shamoon Nov 2016 · McAfee Shamoon December 2018 · Symantec Shamoon 2012ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e9c5234-65e9-4b4a-bc13-891e7aed84b2
Palo Alto Shamoon Nov 2016 · Unit 42 Shamoon3 2018ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5206976b-ac4d-4286-a954-4b1ef5c20adc
Palo Alto Shamoon Nov 2016 · McAfee Shamoon December 2018ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59df5f14-e570-417e-8184-e8e7c6c1ea75
Palo Alto Shamoon Nov 2016ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e6e745f-d756-4b6e-90e1-3adcf848570b
Unit 42 Shamoon3 2018 · FireEye Shamoon Nov 2016ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73a53379-746e-46db-b101-1fc45df5e458
Palo Alto Shamoon Nov 2016 · McAfee Shamoon December19 2018ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1134.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--755bc45a-9048-4f58-b405-2ea8329328a1
McAfee Shamoon December 2018ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ab5ee87-6fdf-447a-b622-0a68ed34e330
Palo Alto Shamoon Nov 2016ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8dd9d97d-0eb1-4e17-94ac-5589db51f878
Palo Alto Shamoon Nov 2016 · FireEye Shamoon Nov 2016ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8fe32611-4206-4bef-9698-dbcefde08090
Unit 42 Shamoon3 2018ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af9347a3-00a9-4ece-b075-8c55bd4f4b9b
Palo Alto Shamoon Nov 2016 · FireEye Shamoon Nov 2016 · McAfee Shamoon December 2018ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5a7cf46-a3ab-4d33-a43f-012c0c5fdf63
Palo Alto Shamoon Nov 2016ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2ff2c76-04ed-41c4-bd35-75f7cf823aee
Unit 42 Shamoon3 2018 · McAfee Shamoon December 2018ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7f4f6eb-05b8-43af-8d8a-e06b1d950165
Palo Alto Shamoon Nov 2016 · Unit 42 Shamoon3 2018ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1f4c08f-b5b1-4d62-8f1c-75f4302b0bce
FireEye Shamoon Nov 2016ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ebf68107-a2b8-4ff1-916f-e1861a20914a
McAfee Shamoon December 2018ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed94edc7-e687-409e-9143-20a15190bd83
Palo Alto Shamoon Nov 2016