PARIS // The cyberattacks that have hit Saudi Arabia over the past few months are continuing, researchers at US antivirus firm McAfee said, revealing new details about an unusually disruptive campaign.
One of McAfee’s chief scientists Raj Samani said the latest intrusions were very similar, albeit even worse, to the malicious software that wrecked computers at Saudi Arabia’s state-run oil company in 2012, dubbed Shamoon.
McAfee drew several connections to the Shamoon attack, which has been linked to Iran, but stopped short of blaming anyone for the attacks, in line with industry practice.
“This campaign was a lot bigger,” Mr Samani said. “Way larger in terms of the amount of work that needed to be done.”
It is a striking claim as the 2012 intrusions against Saudi Aramco and Qatari natural gas company RasGas — data-wiping attacks that wrecked tens of thousands of computers — were among the most serious cyberattacks ever publicly revealed. At the time, the US called it “the most destructive attack that the private sector has seen to date”.
McAfee said in a blog post published Wednesday that it had detected three waves of electronic intrusions aimed at sabotaging organisations across Saudi Arabia starting on November 17.
A second wave hit on November 28. The third wave is ongoing.
Unlike more traditional forms of cyberespionage, which are aimed at stealing information, these intrusions were aimed at causing widespread disruption by wiping data off hard drives.
Echoing research done by others, McAfee said the most recent wave of attacks drew heavily on the malicious code used in the 2012 intrusions.
McAfee also said that some of the code appears to have been borrowed by a previously known hacking group, Rocket Kitten, and used digital infrastructure also employed in a cyberespionage campaign dubbed OilRig. US cybersecurity firms have tied both to Iran, with greater or lesser degrees of certainty.
Saudi officials have given little detail about the intrusions beyond saying that more than a dozen government agencies and companies were affected.
* Associated Press