Loading malware…
Dustman is a destructive wiper malware family associated with Iranian state-sponsored operations and publicly linked to attacks in the Arabian Peninsula, including the 2019 intrusion against Bahrain’s national oil company Bapco. It is widely described as closely related to ZeroCleare and as part of a broader Iranian arsenal of disk- and file-destructive malware used against energy and industrial-sector targets.
Dustman is characterized as a wiper rather than financially motivated ransomware. Reporting consistently places it in campaigns intended to disrupt operations and destroy data, especially in Middle Eastern energy environments. It has been discussed alongside Shamoon and ZeroCleare as part of a lineage of destructive tooling that abuses legitimate or modified drivers to achieve low-level destructive effects on Windows systems. Multiple assessments tie Dustman to Iranian threat activity, with references variously connecting it to APT34/OilRig and to broader Iranian state-aligned disruptive operations.
Victimology and campaign context indicate a focus on energy and industrial organizations in the Gulf region. Dustman has also been cited as a potential follow-on payload in intrusion ecosystems used for long-term access, reconnaissance, and staging by Iranian operators. Available high-confidence reporting supports its role as a destructive payload used after compromise, but does not provide enough corroborated detail here to describe a specific initial infection chain for Dustman itself.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In 2019-2020, a couple new wipers – ZeroCleare and Dustman, were exposed in 2 operations against entities in the Arabian Peninsula.
In 2019-2020, a couple new wipers – ZeroCleare and Dustman, were exposed in 2 operations against entities in the Arabian Peninsula.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A successor to ZeroCleare, Dustman is a destructive wiper that uses modified legitimate drivers to achieve destructive effects.
An Iran-linked wiper malware family mentioned as part of a set of destructive tools designed to wipe data and disrupt operations.
Destructive wiper malware family referenced as part of Iran-aligned wiper tooling.
A destructive malware/wiper referenced in the report title.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.