1. How Seculert Discovered the Shamoon Malware
© 2013 Seculert Company, All Rights Reserved

2. Shamoon is a 2-stage attack targeting Oil & Energy companies
Shamoon Targeted Attack
Shamoon is a 2-stage attack targeting Oil & Energy companies
Comprised of 3 modules
Dropper
Reporter
Wiper
Extracting data via an internal infected machine proxy
Shamoon stages
Data extraction
Wiping machines
Internal proxy used for both Dropper and Reporter.
Worm capabilities to spread itself, by trying to create a scheduled task on remote LAN machines.
© 2013 Seculert Company, All Rights Reserved
#seculertjuly2013

3. Spreading itself on the local network via Scheduled Tasks
Shamoon Targeted Attack
Spreading itself on the local network via Scheduled Tasks
Abuse a legitimate & signed RawDisk driver to wipe MBR
Wiper module Time Bomb
Wipe drive and MBR at specified dates and times
Others copycat this capability
Creating scheduled tasks on remote machines on the local network
Eldos signed
Internal proxy used for both Dropper and Reporter.
Worm capabilities to spread itself, by trying to create a scheduled task on remote LAN machines.
© 2013 Seculert Company, All Rights Reserved
#seculertjuly2013

4. Initial attack vector is still unknown
Shamoon – Why It Wasn’t Prevented
Initial attack vector is still unknown
Physical access / Insider
Partner
Spear phishing
Time based attack (time bomb)
Worm spreading in local network
Using local machine as a proxy
Most of the victim companies were using solutions which are focused on prevention
© 2013 Seculert Company, All Rights Reserved
#seculertjuly2013 4

5. A customer uploaded a suspicious file to the Seculert Elastic Sandbox
How Seculert Identified Shamoon
A customer uploaded a suspicious file to the Seculert Elastic Sandbox
Malware behavioral profile was automatically created
Shamoon was detected on another customer using Big Data analysis of their gateway traffic logs
Customers use Seculert API to enhance their on-premises security devices to protect against Shamoon
© 2013 Seculert Company, All Rights Reserved
#seculertjuly2013 5

6. From Prevention to Protection
Persistent attacks require a new approach
Big Data analytics
Long-term analysis
Advanced malware profiling
Automated expertise
© 2013 Seculert Company, All Rights Reserved
#seculertjuly2013 6

7. © 2013 Seculert Company, All Rights Reserved
Let Seculert Detect Unknown Malware on Your Network Sign-up Now Immediate Results – No Credit Card Required – Initial Results are FREE!
© 2013 Seculert Company, All Rights Reserved