Volume 2Oil and Gas edition2012Last verified 16 sources, 7 primaryNo formal government attribution
In 2012 a wiper erased about 30,000 workstations at Saudi Aramco in a single day. Aramco said oil production never stopped, because its plant systems sat on isolated networks. No government has formally named who did it.
Shamoon reached no control system. It is here because it made wipers a category, malware whose only job is to erase, and because it is the rare entry where the architecture held. Aramco said about 30,000 workstations were affected and, in the same statements, that its exploration and production systems were unaffected because they ran on isolated networks. RasGas said the same of its gas processing.
Aramco’s vice president for corporate planning said the attackers’ main target was the flow of oil and gas. If he is right, the wiper went for the plant and took the office, because the office was all it could reach. That reading is BlastWave’s analysis. Two cautions travel with it. The isolation claim is Aramco’s own and has never been independently audited. And separation protects the process, not the business wrapped around it: how long can a company release product with no office systems at all?
What is not known: No government has ever formally and publicly attributed Shamoon. The US Defense Secretary described it in October 2012 without naming a culprit, and the Saudi Interior Ministry blamed an organised group abroad and named no state. How the malware first got in has never been published. Aramco disclosed no cost. Its statement that production systems sat on isolated networks is the company’s own and has never been independently audited. RasGas never confirmed it was hit by the same malware.
Recommendation
Take the path away By Aramco’s account its plants kept running because nothing on the business network could reach them. Extend that wall to dispatch, loading and custody transfer.
Remove standing credentials No business domain account should be valid on the production side. The 2016 Shamoon variant carried its victims’ own administrator credentials (Unit 42).
Let the office read the plant one way Production data the business needs crosses a unidirectional path, so a wiper on the office side finds nothing on the plant side to write to.
Sources: Aramco statement via Saudi Press Agency, 27 Aug 2012; RasGas via The Register, 30 Aug 2012; Panetta remarks, DoD transcript, 11 Oct 2012; Kaspersky Securelist, 11 Sep 2012; ICS-CERT JSAR-12-241-01B, 16 Oct 2012. Full list with links.
Soft Spots: The isolation claim is Aramco’s own and unaudited. “Went for the plant and took the office” is BlastWave’s analysis, conditional on al-Saadan’s stated intent. The 2015 hard-drive and free-fuel account is single-source.
The full record
Every claim numbered to its source. Last updated .
About 30,000 office workstations wiped, plants that kept running by the company's own account, and a famous speech that never named the attacker. What is verified, what is only reported, and what is still unknown.
Summary
On 15 August 2012, the Shamoon wiper erased about 30,000 workstations on Saudi Aramco's business network, by the company's own count. Aramco said oil production never stopped because its plant control systems ran on isolated networks, a claim never independently audited. Qatar's RasGas lost its office systems days later. No government has formally and publicly attributed the attack.1,3,11,12
Timeline of the Shamoon attack on Saudi Aramco
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Aramco's network services are impacted by what the company later calls "a malicious virus that originated from external sources." As a precaution it isolates all its electronic systems from outside access and says there is no impact on its production operations.1,8The same day two groups post claims on Pastebin: the Cutting Sword of Justice, which says the destruction began at 11:08 a.m. Saudi time, and an Arab Youth Group.5,6
Symantec reports that W32.Disttrack "has already affected at least one organization in the energy sector," without naming it.8
IDG reports that a Kaspersky researcher found a date hardcoded in the malware, 15 August 2012 08:08 UTC, which is 11:08 a.m. in Saudi Arabia. Kaspersky's chief expert calls it only one indication the events could be related, and only if the Pastebin posting is legitimate.5
Aramco says it has restored its main internal network services, that about 30,000 workstations were affected and have been cleaned and restored to service, and that its exploration, production and plant control systems were unaffected because they operate on isolated networks. RasGas in Qatar loses its office computer systems the same day.1,3
The Register reports that RasGas told suppliers by fax of "technical issues with its office computer systems," and that a spokesman said gas extraction and processing were not affected.3
Kaspersky publishes further analysis: the wiper uses the EldoS RawDisk driver and overwrites data with a fragment of a JPEG image of a burning US flag. It adds a caveat: "we still cannot definitively confirm."9
Defense Secretary Leon Panetta describes Shamoon at Aramco and a similar attack on RasGas in a speech in New York. He names no perpetrator.11
An Associated Press story runs under the headline "Iran hackers behind Gulf oil cyberattacks, U.S. says." Its own text says Panetta did not directly link Iran to the Gulf attacks; its attribution rests on unnamed officials.13
ICS-CERT releases JSAR-12-241-01B on Shamoon/DistTrack. It names no victim and no attacker. It is last revised on 3 January 2014.14
The Saudi Interior Ministry says an organized group operating from abroad was behind the attack and names no state. Aramco's vice president for corporate planning says the main target was to stop the flow of oil and gas.7
The Intercept publishes a leaked April 2013 NSA document that calls the event "Iran's destructive cyber attack against Saudi Aramco."15
CNNMoney publishes a single former adviser's account of bulk hard drive purchases, oil given away free and typewriters. Aramco does not respond to a request for comment.4
Unit 42 reports a new Shamoon variant, Shamoon 2, carrying its victims' own administrator credentials and an image of the drowned Syrian child Alan Kurdi. That image belongs to 2016, not 2012.16
Aramco's base prospectus says no past cyber incident has been material to its financial performance or reputation.10
CISA lists JSAR-12-241-01B among significant historical campaigns targeting ICS, with no attribution.12
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
How many workstations were hit?
About 30,000, by Aramco's own count; cleaned and restored to service1
Verified (company figure)
Did oil production stop?
Not according to Aramco: production plants "fully operational"1,8
Verified (company's account)
Were plant control systems reached?
Not by Aramco's account. It says they sat on isolated networks; no independent audit has been published1
Verified (company's account, unaudited)
What malware was it?
Shamoon / W32.Disttrack, per Symantec and Kaspersky; linked to Aramco by the Defense Secretary in October 2012. Aramco said "a malicious virus"1,8,9,11
Researcher finding
Who carried it out?
No government has formally and publicly attributed it. Claimed on Pastebin by hacktivist groups5,7
Not disclosed. The 2019 prospectus says no past cyber incident was material10
Undisclosed
Hard drives bought in bulk, oil given away free
One former adviser to CNNMoney, three years later; Aramco did not respond4
Reported only (single source)
Did Shamoon stop oil production at Saudi Aramco?
Not according to Aramco, and nothing on the record says otherwise. On 15 August 2012 the company said the interruption had "no impact whatsoever on any of the company's production operations."8 Its restoration statement of 27 August said its primary enterprise systems of hydrocarbon exploration and production were "unaffected as they operate on isolated network systems," and that production plants were "fully operational as these control systems are also isolated."1
"restored all its main internal network services that were impacted on August 15, 2012, by a malicious virus that originated from external sources and affected about 30,000 workstations"
RasGas, in Qatar, said the same of its own plant: its problem was "technical issues with its office computer systems," and a spokesman said gas extraction and processing were not affected.3 The US advisory on the malware, JSAR-12-241-01B, says "no evidence exists that Shamoon specifically targets industrial control systems (ICSs) components."14
Two cautions apply. The isolation claim is the company's own, and no independent audit of Aramco's or RasGas's separation between business IT and plant control has been published. And Aramco's vice president for corporate planning, Abdullah al-Saadan, said on 9 December 2012 that the attackers' main target was to stop the flow of oil and gas.7 That is the victim's statement of the attackers' intent, not evidence of any effect on production.
How many computers did Shamoon destroy?
About 30,000 workstations were wiped and left unbootable, by Aramco's count, and the company said they were cleaned and restored to service.1 The figure is Aramco's own, from its August 2012 statements. It was repeated in reporting of al-Saadan's remarks in December 2012, where it sits in the reporters' text rather than in his quoted words.7 Aramco said its main internal network services were back in about ten days, and that as a precaution remote internet access to online resources was restricted.1
Two larger versions circulate. The Defense Secretary went further than the victim in his October 2012 speech:
"More than 30,000 computers ... rendered useless and had to be replaced"
He also said it "virtually destroyed" them.11 Aramco said the workstations were cleaned and restored. The figure of 35,000 computers "partially wiped or totally destroyed" comes from CNNMoney in August 2015, not from Aramco.4
Did the United States blame Iran for Shamoon?
No government has formally and publicly attributed Shamoon, and the speech most often cited as the United States blaming Iran does not do so. On 11 October 2012 Defense Secretary Leon Panetta described Shamoon in detail: a routine called a wiper, coded to self-execute, that replaced crucial systems files with an image of a burning US flag, followed by a similar attack on RasGas. He called it probably the most destructive attack the private sector had seen to date. He named no perpetrator.11 The only sentence about Iran sits some thirty paragraphs later, in a separate passage about building the Defense Department's own cyber capabilities:
"It's no secret that Russia and China have advanced cyber capabilities. Iran has also undertaken a concerted effort to use cyberspace to its advantage."
The next day an Associated Press story ran under the headline "Iran hackers behind Gulf oil cyberattacks, U.S. says." Its own text says "Panetta did not directly link Iran to the Gulf attacks"; the attribution in it came from unnamed officials.13
The Saudi Interior Ministry said on 9 December 2012 that an organized group operating from abroad was responsible, and named no state.7
A leaked April 2013 NSA document, published by The Intercept in February 2015, calls it "Iran's destructive cyber attack against Saudi Aramco." It is a classified assessment published without authorization, not a public government attribution.15
ICS-CERT's advisory names no victim and no attacker, and CISA's 2021 list of historical ICS campaigns carries it with no attribution.12,14
Who claimed responsibility for Shamoon?
Two self-described hacktivist groups claimed it on Pastebin on 15 August 2012, and only one claim matched anything in the malware. One post was signed by an Arab Youth Group.6 The other, signed by the Cutting Sword of Justice, gave a start time:
"The destruction operations began on Wednesday, Aug 15, 2012 at 11:08 AM"
A Kaspersky researcher later found a date hardcoded in the malware: 15 August 2012, 08:08 UTC, which is 11:08 a.m. in Saudi Arabia. Kaspersky's chief expert, Alexander Gostev, called it only one indication that the events could be related, and only if the Pastebin posting was legitimate.5 In September Kaspersky added its own caveat: "we still cannot definitively confirm."9 The link between the malware and Aramco began as circumstantial; it was stated by the Defense Secretary in October 2012.11 Both groups are recorded here as "claimed by," not as attributed.
What was Shamoon and how did it work?
Shamoon, also called W32.Disttrack, was a wiper: malware whose only job is to erase. Symantec reported on 16 August 2012 that it had already affected at least one energy-sector organization, without naming it.8 Kaspersky found that it used the signed EldoS RawDisk driver to overwrite files and the master boot record, and that the overwrite data was a fragment of a JPEG image of a burning US flag.9 How it first got into Aramco has never been published.
The images belong to their years. The burning flag is 2012. The photograph of the drowned Syrian child Alan Kurdi was used by Shamoon 2 in November 2016, a later variant that Unit 42 found carried its victims' own administrator credentials and spread with them.16 The 2016 image has nothing to do with the 2012 attack on Aramco.
What is still not known about Shamoon
Who carried out the 2012 attack. No government has formally and publicly attributed it.
How the malware first got into Aramco's network. Neither Aramco, the Saudi government nor any responder has published it.
How widely credentials were shared across Aramco's network in 2012.
Whether Aramco's and RasGas's separation between office and plant would survive an independent audit. The isolation claim is the companies' own.1,3
Whether RasGas was hit by the same malware. RasGas never named it.3
What the incident cost. Aramco disclosed no figure.10
Whether the 2015 account of bulk hard drive purchases and halted domestic fuel sales is accurate. It rests on one source, three years after the event.4
Claims about Shamoon the record does not support
Widely repeated claim
What the record says
"Iran hackers behind Gulf oil cyberattacks, U.S. says."
The headline of an Associated Press story of 12 October 2012. Its own text says Panetta did not directly link Iran to the attacks; the attribution came from unnamed officials. No government has formally and publicly attributed Shamoon.11,13
"35,000 computers were partially wiped or totally destroyed."
Aramco's figure is about 30,000 workstations, which it said were cleaned and restored to service. The 35,000 figure is CNNMoney's, in 2015.1,4
"More than 30,000 computers ... rendered useless and had to be replaced"
The Defense Secretary's words. Aramco said the workstations were cleaned and restored to service.1,11
"Aramco bought 50,000 hard drives and gave oil away free."
One former adviser to the company, to CNNMoney in August 2015. Aramco did not respond to a request for comment. Unconfirmed.4
"Iran's destructive cyber attack against Saudi Aramco."
Wording from a leaked April 2013 NSA document published by The Intercept in 2015: a classified assessment published without authorization, not a public government attribution.15
BlastWave analysis: the wall held, by the victim's account
Analysis, not a disclosed fact
Shamoon reached no control system. It matters for two reasons: it made wipers a category, malware set on a timer against a named company with a political image where the data used to be, and it is the rare case where the separation between business IT and plant control held, by the victim's own account. Aramco said about 30,000 workstations were affected and, in the same statements, that its exploration and production systems were unaffected because they ran on isolated networks. RasGas said the same of its gas processing.1,3 Aramco's vice president for corporate planning said the attackers' main target was the flow of oil and gas.7 If he is right, the wiper went for the plant and took the office, because the office was all it could reach. That reading is BlastWave's analysis, not a disclosed fact. The operator comes out of this well: it cut its network off from outside access, cleaned the machines and restored main services in about ten days.
Two cautions travel with the argument. The isolation claim is Aramco's own and has never been independently audited, so this entry carries it as the company's account. And separation protects the process, not the business wrapped around it. The single 2015 account of hard drives bought in bulk and domestic fuel sales halted is unconfirmed, but it points at the right question: how long a company can release product with no office systems at all.4 That question, too, is BlastWave's analysis, not a disclosed fact.
Podcast: “The Booking Office” (9:27). Joe Baxter and Cam Cullen on why the wall between the office and the plant held, and what that wall could not protect.
Video: Shamoon Short (60 to 90 seconds).
Frequently asked questions
What happened in the Shamoon attack on Saudi Aramco?
On 15 August 2012 a wiper later identified as Shamoon overwrote about 30,000 workstations on Saudi Aramco's business network, by the company's own count. Aramco cut its systems off from outside access, cleaned and restored the workstations, and said on 27 August that its main internal network services were back. It said oil production was never affected. Qatar's RasGas lost its office computer systems from 27 August.
Did Shamoon stop oil production at Saudi Aramco?
Not according to Aramco. In August 2012 the company said its exploration and production systems were unaffected because they operate on isolated networks, and that its production plants were fully operational. RasGas said its gas extraction and processing were not affected. These are the companies' own statements; no independent audit of their network separation has been published, and no record shows any halt to production.
How many computers did Shamoon destroy?
Aramco said in August 2012 that about 30,000 workstations were affected and later cleaned and restored to service, so wiped is more accurate than destroyed. Defense Secretary Leon Panetta said in October 2012 that more than 30,000 computers were rendered useless and had to be replaced. The figure of 35,000 comes from a CNNMoney story in August 2015, not from Aramco.
Did the United States blame Iran for Shamoon?
Not formally or publicly. Defense Secretary Leon Panetta described Shamoon in detail in a speech on 11 October 2012 and named no perpetrator; his only sentence about Iran sits in a separate passage about adversaries' capabilities. An Associated Press headline the next day said the US blamed Iranian hackers, but the story's own text says Panetta did not directly link Iran to the attacks, and its attribution came from unnamed officials.
Who was behind the Shamoon attack?
No government has formally and publicly attributed it. Two groups, the Cutting Sword of Justice and an Arab Youth Group, claimed it on Pastebin on 15 August 2012. The Saudi Interior Ministry said in December 2012 that an organized group operating from abroad was responsible and named no state. A leaked 2013 NSA document published in 2015 calls it Iran's attack, but it is not a public attribution.
What kind of malware was Shamoon?
Shamoon, also called W32.Disttrack, is a wiper: malware built to erase data. Kaspersky reported in September 2012 that it used the signed EldoS RawDisk driver to overwrite files and the master boot record, with a fragment of a JPEG image of a burning US flag as overwrite data. A later variant, Shamoon 2, reported by Unit 42 in November 2016, carried its victims' own administrator credentials.
Was RasGas hit by Shamoon?
RasGas never said so. In August 2012 the Qatari LNG producer told suppliers of technical issues with its office computer systems, and a spokesman said gas extraction and processing were not affected. The link to Shamoon rests on Defense Secretary Leon Panetta's October 2012 reference to a similar attack on RasGas and on press reporting, not on any statement by the company.
Primary sources are Saudi Aramco's own dated statements, US government transcripts and advisories, the company's securities filing and the named researchers who analyzed the malware. Aramco's and RasGas's words are often available only through the reporting that carried them, and are labeled that way. Press is cited only as evidence of what was said.
CompanySaudi Aramco, statement on restoration of network services, Dhahran, 27 Aug 2012, as published by the Saudi Press Agency (spa.gov.sa).
PressThe Register (John Leyden), report on Saudi Aramco's statements, 29 Aug 2012. Cited as a carrier of the company's words. theregister.com
PressThe Register, report on RasGas's fax to suppliers and its spokesman's statement, 30 Aug 2012. Cited as a carrier of the company's words. theregister.com
PressCNNMoney, "The inside story of the biggest hack in history," 5 Aug 2015. Single named source; Aramco did not respond to a request for comment. Cited as evidence of what was said. money.cnn.com · CNN Wire republication
PressLucian Constantin, IDG News Service, "Kill timer found in Shamoon malware suggests possible connection to Saudi Aramco attack," 23 Aug 2012 (CSO Online; also Network World). Quotes Kaspersky Lab's Dmitry Tarakanov and Alexander Gostev and the Cutting Sword of Justice post. Cited as evidence of what was said. csoonline.com · Network World copy
PressArab Youth Group, claim of responsibility posted on Pastebin, 15 Aug 2012. Cited only as evidence that the claim was made.
PressStatements of Saudi Interior Ministry spokesman Maj. Gen. Mansour al-Turki and Saudi Aramco vice president for corporate planning Abdullah al-Saadan (Al Ekhbariya), 9 Dec 2012, as reported by The Register (10 Dec 2012) and the Associated Press. Cited as evidence of what was said. theregister.com · Associated Press via Yahoo News
PressSecurityWeek, 16 Aug 2012, carrying Saudi Aramco's statement of 15 Aug 2012 and Symantec's W32.Disttrack finding. Cited as evidence of what was said. securityweek.com
ResearcherKaspersky Lab, "Shamoon the Wiper: Further Details (Part II)," Securelist, 11 Sep 2012. securelist.com
Company filingSaudi Arabian Oil Company, Base Prospectus dated 1 April 2019, Risk Factors (IT systems), London Stock Exchange RNS. PDF
FederalUS Department of Defense, News Transcript 5136, "Remarks by Secretary Panetta on Cybersecurity to the Business Executives for National Security, New York City," 11 Oct 2012 (archived copy of 16 Oct 2012). archived defense.gov
FederalCISA, "Significant Historical Cyber-Intrusion Campaigns Targeting ICS," 2021. Lists JSAR-12-241-01B with no attribution. cisa.gov
PressAssociated Press (Lolita C. Baldor), "Iran hackers behind Gulf oil cyberattacks, U.S. says," 12 Oct 2012, as republished by MPR News. Cited as evidence of what was said. mprnews.org
FederalICS-CERT, Joint Security Awareness Report JSAR-12-241-01B, "Shamoon/DistTrack Malware (Update B)," original release 16 Oct 2012, last revised 3 Jan 2014. archived ics-cert.us-cert.gov
PressGlenn Greenwald, "NSA Claims Iran Learned from Western Cyberattacks," The Intercept, 10 Feb 2015, publishing an April 2013 NSA document. Cited as evidence of what the leaked document says. theintercept.com
ResearcherRobert Falcone, Palo Alto Networks Unit 42, "Shamoon 2: Return of the Disttrack Wiper," 30 Nov 2016. unit42.paloaltonetworks.com
Cite this page
BlastWave. “Shamoon Wiper Attack on Saudi Aramco (2012): What Is Verified.” Hackopedia, Volume 2, FILE 029. Last verified 28 September 2026. https://hackopedia.blastwave.com/oil-and-gas/shamoon-2012/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 029 in Hackopedia Volume 2, in the Oil and Gas edition.
28 Sep 2026
Hand-check at source of the remaining items: the Cutting Sword of Justice start time, the date hardcoded in the malware and Kaspersky's caveat, and Aramco's 2019 prospectus statement that no past cyber incident was material.
26 Sep 2026
Full validation against primary sources: the Defense Secretary's speech read in full on the archived Defense Department transcript, the ICS-CERT advisory on its archived page, and Aramco's restoration statement on the Saudi Press Agency's site. Quotations from the speech and the Associated Press story checked word for word.
24 Sep 2026
Entry built from primary sources.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
