Shamoon Group

Also reported as Cutting Sword of Justice. Linked to Iran by two sources.

Reports: 20
Last reported: 26 September 2022
Known CVEs: 5
Origin: Iran

ID: shamoon-group
Sources: MISP Malpedia
Merge evidence: 2 alias matches

Reports per quarter

2012 Q3: 3 reports
2012 Q4: no reports
2013 Q1: no reports
2013 Q2: no reports
2013 Q3: no reports
2013 Q4: no reports
2014 Q1: no reports
2014 Q2: no reports
2014 Q3: no reports
2014 Q4: no reports
2015 Q1: no reports
2015 Q2: no reports
2015 Q3: no reports
2015 Q4: no reports
2016 Q1: no reports
2016 Q2: no reports
2016 Q3: no reports
2016 Q4: 2 reports
2017 Q1: 5 reports
2017 Q2: 1 report
2017 Q3: no reports
2017 Q4: no reports
2018 Q1: no reports
2018 Q2: no reports
2018 Q3: no reports
2018 Q4: 2 reports
2019 Q1: no reports
2019 Q2: no reports
2019 Q3: no reports
2019 Q4: 1 report
2020 Q1: 1 report
2020 Q2: no reports
2020 Q3: no reports
2020 Q4: no reports
2021 Q1: no reports
2021 Q2: no reports
2021 Q3: 1 report
2021 Q4: no reports
2022 Q1: 1 report
2022 Q2: 1 report
2022 Q3: 2 reports

Dated reports, 2012 Q3 to 2022 Q3.

CVEs named in reports

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

26 September 2022

The Anatomy of Wiper Malware, Part 3: Input/Output Controls | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Anatomy of Wiper Malware, Part 3: Input/Output Controls | CrowdStrike
12 August 2022

The Anatomy of Wiper Malware, Part 1: Common Techniques | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Anatomy of Wiper Malware, Part 1: Common Techniques | CrowdStrike
28 April 2022

An Overview of the Increasing Wiper Malware Threat | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An Overview of the Increasing Wiper Malware Threat | FortiGuard Labs
8 March 2022

Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf
5 August 2021

Attacks Against Critical Infrastructure (White Paper)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks Against Critical Infrastructure (White Paper)
10 February 2020

FBI warns about ongoing attacks against software supply chain companies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FBI warns about ongoing attacks against software supply chain companies
21 December 2019

Shamoon 2012 Full Analysis

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Shamoon 2012 Full Analysis
14 December 2018

Shamoon: Destructive Threat Re-Emerges with New Sting in its Tail

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shamoon: Destructive Threat Re-Emerges with New Sting in its Tail
13 December 2018

Shamoon 3 Targets Oil and Gas Organization

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shamoon 3 Targets Oil and Gas Organization
20 April 2017

2017%20FireEye%20M-Trends%20Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2017%20FireEye%20M-Trends%20Report.pdf

Show all 20 reports Show fewer

26 March 2017

Shamoon 2: Delivering Disttrack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shamoon 2: Delivering Disttrack
6 March 2017

From Shamoon to StoneDrill

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor From Shamoon to StoneDrill
27 February 2017

Endpoint Protection - Symantec Enterprise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Endpoint Protection - Symantec Enterprise
23 January 2017

Greenbug cyberespionage group targeting Middle East, possible links to Shamoon

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Greenbug cyberespionage group targeting Middle East, possible links to Shamoon
9 January 2017

Second Wave of Shamoon 2 Attacks Identified

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Second Wave of Shamoon 2 Attacks Identified
30 November 2016

Endpoint Protection - Symantec Enterprise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Endpoint Protection - Symantec Enterprise
30 November 2016

Shamoon 2: Return of the Disttrack Wiper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shamoon 2: Return of the Disttrack Wiper
17 August 2012

Shamoon or DistTrack.A samples

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shamoon or DistTrack.A samples
16 August 2012

Shamoon the Wiper - Copycats at Work

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shamoon the Wiper - Copycats at Work
16 August 2012

The Shamoon Attacks | Symantec Connect Community

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor The Shamoon Attacks | Symantec Connect Community

Newest first. Details opens the report in Explore.