APT33 Suspected in Latest Shamoon Attacks Targeting Middle East and European Energy Sector

In December 2018, a wave of destructive cyberattacks hit energy-sector companies in the Middle East and Europe. The attackers deployed Shamoon Version 3 — a data-wiping malware — alongside a new file-erasure tool called Filerase. Together, these tools deleted files across targeted networks, causing significant operational disruption. The groundwork for the attack had been laid months earlier, with credential harvesting starting as far back as August 2018.

McAfee researchers concluded that APT33 — an Iranian threat group — or a group deliberately impersonating APT33, is likely responsible for the attacks. The attribution is based on analysis of three generations of the Shamoon wiper, tooling overlaps, and behavioral patterns consistent with prior APT33 campaigns. The source notes the possibility that another actor may have used APT33 tradecraft to obscure their identity.

The primary goal was sabotage — rendering targeted organizations' systems inoperable by permanently destroying data. The attackers were not after financial gain or intelligence. Their aim was to cause maximum operational disruption, as seen in previous Shamoon campaigns. The inclusion of Quranic text inside the wiper code suggests a politically or ideologically motivated dimension to the operation.

The campaign targeted multiple organizations across the Middle East and Europe, with a focus on the energy sector. Shamoon Version 3 extended the reach of prior campaigns — which had concentrated on Saudi Arabia — by going after Middle Eastern targets through their European suppliers, introducing a supply-chain dimension. While the exact number of victim organizations was not disclosed, the campaign affected multiple companies across both regions.

The energy sector was the primary target. The fake job-offering websites used to harvest credentials were largely themed around energy-sector employment. European companies appear to have been targeted indirectly, as suppliers to Middle Eastern energy organizations, rather than as primary targets in their own right. No specific company names were disclosed in the McAfee report.

The attackers first set up fake websites mimicking energy-sector job portals to collect corporate usernames and passwords. Victims who visited these sites either executed malicious HTML application files — which silently ran PowerShell scripts to download additional payloads — or entered their credentials directly. With those credentials in hand, the attackers logged into victim networks and used a .NET toolkit to spread the Shamoon and Filerase wipers to targeted machines, ultimately triggering the destructive payload.

Energy infrastructure — particularly in the Middle East — is a high-value geopolitical target. Disrupting oil and gas operations can have broad economic and political consequences for nation-states. APT33 has a documented history of targeting aviation and energy sectors, making these organizations a consistent focus. European suppliers are attractive as softer entry points into otherwise well-defended primary targets.