Shamoon's Latest Version: A Growing Threat to the Middle East and European Industries

In December 2018, a new version of the Shamoon destructive malware — known as Version 3 — was identified during an active breach response by McAfee's incident response team. The malware hit oil, gas, energy, telecom, and government organizations in the Middle East and southern Europe, wiping all data from infected machines and leaving them completely inoperable.

In December 2018, a new version of the Shamoon destructive malware — known as Version 3 — was identified during an active breach response by McAfee's incident response team. The malware hit oil, gas, energy, telecom, and government organizations in the Middle East and southern Europe, wiping all data from infected machines and leaving them completely inoperable.

McAfee did not attribute this specific report to any particular threat actor. However, Shamoon has historically been linked to Iranian threat groups, and a follow-up McAfee report five days later attributed related December 2018 Shamoon activity to APT33 — or a group impersonating them. The presence of bugs in the V3 code suggests it may have been in a test phase, potentially indicating a newer or less experienced operator within the same threat ecosystem.

The attack was purely destructive. Shamoon V3 was designed to permanently wipe all data from targeted systems, trigger a forced reboot, and render machines completely inoperable. There was no ransomware demand or data theft involved. The goal was to cause maximum operational disruption to critical-sector organizations — consistent with the sabotage motivation seen in prior Shamoon campaigns.

Multiple organizations across the Middle East and southern Europe were hit in this wave. The campaign continued Shamoon's history of broad targeting within critical industries — previously Saudi Arabia in 2012 and 2016, now expanding to southern Europe as well. No specific count of victim organizations was disclosed, but the scope spanned multiple sectors and two geographic regions simultaneously.

The primary targets were oil, gas, and energy companies in the Middle East — the same industries Shamoon has consistently focused on since 2012. Telecom providers and government agencies were also hit in this wave. Southern European organizations appear to have been targeted as well, likely as part of the same campaign that later used European suppliers as a route into Middle Eastern primary targets.

Once on a system, Shamoon V3 drops three components from encrypted resources embedded in the dropper: a communication module, a wiper, and a 64-bit dropper variant. It then elevates its privileges by impersonating system tokens, creates a persistent autostart service (MaintenaceSrv), and spreads laterally across the network via Windows administrative shares. The wiper uses a raw disk driver (ElRawDisk.sys) to overwrite every file and disk sector with garbage data, then forces a system reboot — leaving machines with a blue screen or driver error and no path to recovery.

Energy and oil and gas infrastructure are high-value geopolitical targets — disrupting them causes broad economic and national security consequences. Shamoon has targeted this sector exclusively across all three of its major campaigns, suggesting a consistent strategic interest in degrading the energy capabilities of Middle Eastern nations. Telecom and government organizations add political and communication disruption value to the same campaign.