The episode examines the 2012 destructive cyber-attack against Saudi Aramco, the Shamoon wiper, the suspected Iranian connection, and the subsequent rebuilding of Aramco’s security operations.
Topics: Destructive wiper malware, Logic bombs and timed payload execution, Master boot record destruction, Flat-network architecture and lack of segmentation, Phishing-based initial access, Exploitation of unpatched document software, Domain-controller compromise and administrative privileges, Industrial control systems and IT/OT separation, Distributed denial-of-service attacks, Default credentials on security appliances, Incident response and network isolation, Security operations center design and network visibility, Cyberwarfare and nation-state attribution
Official episode-page sources
Links published on the Darknet Diaries episode page. Not LLM output.
The 2012 attack struck Saudi Aramco and gave the attackers administrative access to its network.
ExplicitConfidence 99% · Jack RhysiderEP 30Details
“Saudi Aramco. You may not ever have heard of Saudi Aramco before and neither did I until I started researching this story and that’s because they don’t sell to consumers. Instead they sell to manufacturers and distributors so what do they do? Saudi Aramco is one of the largest oil and natural gas producers in the world. It controls massive amounts of oil reserves. It drills it and ships it all over the world. Saudi Aramco may be the most profitable company in existence and produces 25% of the global oil. It’s not a publically trading company though, so we really don’t know how much it’s worth. Because Saudi Aramco is huge and operating globally, it has a lot of computers.
There are pump stations, plants, shipping terminals, logistics centers, laboratories, research and development centers, and storage facilities. Let’s not forget the teams it takes to run it. There’s an HR department, IT department, marketing, truck drivers, mechanics, engineers, public relations, finance, drilling teams, and advisors. Add all that up and Saudi Aramco has over 50,000 employees. Imagine how many computers there are at a company that has 50,000 employees. Not only do a lot of them have individual computers to work on but there’s a lot of servers; domain controllers, e-mail servers, SharePoint systems, files servers, and more. In 2012 Saudi Aramco had over 40,000 computers in their network worldwide. Now I say 2012 because that was when the most profitable company in the world was hit with the most devastating cyber-attack any company has ever seen.”
The Pastebin warnings connected with the attack were signed by The Cutting Sword of Justice; the transcript does not establish that the group conducted the attack.
ExplicitConfidence 96% · Jack RhysiderEP 30Details
“The Pastebin was signed by someone calling themselves The Cutting Sword of Justice”
Some security researchers believed the attack was retaliation from Iran for Stuxnet, but the episode presents this as a theory rather than a confirmed attribution.
UncertainConfidence 78% · Jack RhysiderEP 30Details
“some security researchers believe this was a retaliation from Iran because of the Stuxnet attack”
Shamoon Attacks 2 and 3 were described as ongoing attacks against Saudi Arabia, especially its critical infrastructure and airports.
ExplicitConfidence 97% · Chris KubeckaEP 30Details
“There’s now Shamoon Attacks 2 and 3 that are still ongoing against Saudi Aramco and Saudi Arabia, especially hitting Saudi Arabian critical infrastructures”