- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Iran(high confidence)
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-0936 · shamoon-group
IranWhat it is
Shamoon Group is an Iran-linked threat actor associated with destructive Shamoon wiper operations targeting organizations in the Middle East, especially in the energy sector.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Cutting Sword of Justice
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- Shamoon
- Wiper
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de