Hack or Attack? Shamoon and the Evolution of Cyber Conflict

Abstract
On August 15, 2012, the Saudi Arabian Oil Company (also known as Saudi Aramco), the national oil company of Saudi Arabia and the world’s largest oil producer, was struck by a computer virus that spread across as many as 30,000 Windows-based personal computers operating on the company’s network. According to news sources, it may have taken Aramco almost two weeks to fully restore its network and recover from the incident. The computer security research community dubbed the virus reputed to have spread across Aramco’s network Shamoon. Although there was no apparent oil spill, explosion or other major fault in Aramco operations, the incident impacted production and business processes of the company as at least some drilling and production data were likely lost. Shamoon was also found to have propagated to the networks of other oil and gas firms, including that of RasGas, a joint venture of Qatar Petroleum and US-based ExxonMobil. The following study covers the background and context of the Shamoon incident, and itemizes open-source facts and public statements surrounding the episode.