Loading malware…
Shamoon, also known as DistTrack, is a destructive Windows malware family best known for large-scale wiper attacks against organizations in the Middle East, especially the energy sector. First publicly documented in 2012 and later reappearing in updated waves in 2016, 2017, and 2018, Shamoon combines destructive disk-wiping functionality with supporting components for deployment, lateral spread, and limited host profiling. It has been widely associated with Iranian state-sponsored activity, and U.S. government attribution has linked it to Iranian actors.
Shamoon is typically described as a multi-component malware set consisting of a dropper, a communications or reporting module, and a wiper. Its primary impact is destruction: it overwrites files, damages partition information, and corrupts the master boot record, rendering infected Windows systems unbootable or otherwise unusable. Multiple campaigns used a legitimate disk-access driver to obtain low-level access needed to overwrite protected disk structures, a technique later echoed by other wiper families.
Beyond wiping, Shamoon includes post-compromise functionality that supports propagation and execution across enterprise environments. Documented behavior includes copying its payload to remote systems, creating scheduled tasks or remote services for execution, enabling RemoteRegistry, modifying Windows settings to relax UAC remote restrictions, authenticating to remote hosts with stolen administrator credentials embedded in the malware, and enumerating the local network based on the victim host’s addressing. It also gathers basic host and network information such as system time, IP address, and local network segment, and some variants include a communications component capable of sending system metadata and receiving commands or additional payloads. Embedded components and configuration data have been observed protected with simple obfuscation and decryption routines including XOR and Base64-derived keys.
Shamoon has been characterized as a destructive malware family with an information-stealing or reporting component, but its defining purpose is sabotage rather than espionage or monetization. Campaign timing, victimology, and operational design indicate intent to maximize business disruption, including activation at preset dates chosen to increase impact. The malware has been used in attacks that caused severe operational outages, including the well-known 2012 incident affecting tens of thousands of systems at a major Saudi energy company.
Research has also identified code and behavioral overlaps between Shamoon and the Kwampirs malware family, suggesting either shared developers, close collaboration, or evolution within a broader malware ecosystem. Later Shamoon variants appear to have incorporated code patterns associated with Kwampirs, including shared loader and reporting logic. Despite these overlaps, Shamoon remains distinguished by its destructive wiper capability and its role in politically motivated disruptive operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Shamoon, also known as DistTrack, functions as an information-stealing malware that also incorporates a destructive component that allows it to overwrite the Master Boot Record (MBR) with arbitrary data so as to render the infected machine inoperable.
Shamoon, also known as DistTrack, functions as an information-stealing malware that also incorporates a destructive component that allows it to overwrite the Master Boot Record (MBR) with arbitrary data so as to render the infected machine inoperable.
Comparative forensic analysis has revealed the Kwampirs RAT as having numerous similarities with the data destruction malware Disttrack (commonly known as Shamoon).
Shamoon, also known as DistTrack, functions as an information-stealing malware that also incorporates a destructive component that allows it to overwrite the Master Boot Record (MBR) with arbitrary data so as to render the infected machine inoperable.
The wiper rewrites the master boot record (MBR) on connected drives so when the victim next turns on the device, the “From Iran with love – Shamoon” message appears on the screen, and the operating system will not load.
The virus, named Shamoon after a word in its code, was designed to overwrite critical files with an image of a burning American flag.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
The Disttrack malware spreads to other systems automatically using stolen credentials.
The FBI has sent a security alert to the US private sector about an ongoing hacking campaign that's targeting supply chain software providers... 'Software supply chain companies are believed to be targeted in order to gain access to the victim's strategic partners and/or customers, including entities supporting Industrial Control Systems (ICS) for global energy generation, transmission, and distribution,'
this method calls the NetScheduleJobAdd function within the Windows netapi32 library to create a scheduled task to run the payload.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
this method calls the NetScheduleJobAdd function within the Windows netapi32 library to create a scheduled task to run the payload.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
The Disttrack malware spreads to other systems automatically using stolen credentials.
ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
OpenSCManagerW ... OpenServiceW ... CreateServiceW ... ChangeServiceConfigW ... StartServiceW ... RegisterServiceCtrlHandlerW ... SetServiceStatus ... sc config TrkSvr binpath= system32\trksrv.exe && ping -n 10 127.0.0.1 >nul && sc start TrkSvr
BitPaymer can suppress UAC prompts by setting the HKCU\Software\Classes\ms-settings\shell\open\command registry key on Windows 10 or HKCU\Software\Classes\mscfile\shell\open\command on Windows 7... LockBit 2.0 can bypass UAC through creating the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ICM\Calibration.
this method calls the NetScheduleJobAdd function within the Windows netapi32 library to create a scheduled task to run the payload.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
The Disttrack malware spreads to other systems automatically using stolen credentials.
OpenSCManagerW ... OpenServiceW ... CreateServiceW ... ChangeServiceConfigW ... StartServiceW ... RegisterServiceCtrlHandlerW ... SetServiceStatus ... sc config TrkSvr binpath= system32\trksrv.exe && ping -n 10 127.0.0.1 >nul && sc start TrkSvr
BitPaymer can suppress UAC prompts by setting the HKCU\Software\Classes\ms-settings\shell\open\command registry key on Windows 10 or HKCU\Software\Classes\mscfile\shell\open\command on Windows 7... LockBit 2.0 can bypass UAC through creating the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ICM\Calibration.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
FileDescription : Distributed Link Tracking Server ... OriginalFilename : trksvr ... SYSTEM\CurrentControlSet\Services\TrkSvr Distributed Link Tracking Server ... C:\Windows\system32\svchost.exe -k netsvcs TrkSvr
The main purpose of the Disttrack malware is to overwrite files and storage partitions in an attempt to destroy data and render the system unusable.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
It then uses the system's IP addresses to enumerate the /24 network (x.x.x.0-255) that the system is networked with, and will attempt to spread to each of these remote systems.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
The content repeatedly describes malware and threat actors collecting the current date, time, or time zone from victim systems, including examples such as "The net time command can be used... to determine the local or remote system time" and commands like "net time \\hostname" and "w32tm /tz".
Examples include 'Bazar can also check if the Russian language is installed,' 'DropBook has checked for the presence of Arabic language,' 'Maze has checked the language of the infected system,' and 'SynAck ... checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.'
After writing itself to the remote system, the dropper creates a service named "ntssrv"... to execute the payload.
Several attacks shared similar methods in that they specifically overwrote the master boot record (MBR) of computers hard drives, which then needed to be physically replaced in many cases.
After overwriting these files and the partition tables, the wiper issues the following command to restart the system
The destruction of the file system, rather than files within the file system, makes it harder to simply restore some files to “repair” the victimized machine.
Several attacks shared similar methods in that they specifically overwrote the master boot record (MBR) of computers hard drives... Similar methods were used in March 2013 to wipe the hard drives of major South Korean banks and media outlets, as well as in the cyber attack against Sony in November 2014.
32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
125 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Destructive malware/wiper referenced as a historical case in discussion of cyber conflict history.
Referenced as historical comparison for destructive malware focused on immediate operational impact.
Destructive malware/wiper referenced only as part of possible links to activity associated with Elfin.
A destructive wiper virus known for crippling Saudi Aramco in 2012, cited as evidence of Iran’s longstanding offensive cyber capability.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.