Saudi Aramco cyber-attack (2012)

“Saudi Aramco. You may not ever have heard of Saudi Aramco before and neither did I until I started researching this story and that’s because they don’t sell to consumers. Instead they sell to manufacturers and distributors so what do they do? Saudi Aramco is one of the largest oil and natural gas producers in the world. It controls massive amounts of oil reserves. It drills it and ships it all over the world. Saudi Aramco may be the most profitable company in existence and produces 25% of the global oil. It’s not a publically trading company though, so we really don’t know how much it’s worth. Because Saudi Aramco is huge and operating globally, it has a lot of computers. There are pump stations, plants, shipping terminals, logistics centers, laboratories, research and development centers, and storage facilities. Let’s not forget the teams it takes to run it. There’s an HR department, IT department, marketing, truck drivers, mechanics, engineers, public relations, finance, drilling teams, and advisors. Add all that up and Saudi Aramco has over 50,000 employees. Imagine how many computers there are at a company that has 50,000 employees. Not only do a lot of them have individual computers to work on but there’s a lot of servers; domain controllers, e-mail servers, SharePoint systems, files servers, and more. In 2012 Saudi Aramco had over 40,000 computers in their network worldwide. Now I say 2012 because that was when the most profitable company in the world was hit with the most devastating cyber-attack any company has ever seen.”

“This wiper virus would be known as the Shamoon virus.”

“The attackers likely got in through a phishing e-mail.”

“the file would attempt to exploit one of these known vulnerabilities to gain access to the computer”

“because their network was flat, once you got into any part of the network you could get to anything, anywhere”

“When the attackers got into Saudi Aramco, they were able to move around with ease.”

“The attackers focused on these domain controllers”

“the attackers had access to Saudi Aramco’s network and had administrative privileges to the domain controllers”

“the attackers launched a massive DDoS attack against them”

“had left some of the stuff with default usernames and passwords on the network and security appliances”

“The Pastebin was signed by someone calling themselves The Cutting Sword of Justice”

“According to the Saudi Arabian government, it was the country of Iran.”

“some security researchers believe this was a retaliation from Iran because of the Stuxnet attack”

“This incident with Saudi Aramco is known as the Shamoon Attacks 1.”