A version of the destructive computer virus that crippled tens of thousands of computers at Middle Eastern energy companies four years ago was used in mid-November to attack computers in Saudi Arabia and elsewhere in the region, according to US security firms.
CrowdStrike, Palo Alto Networks Inc, Symantec and FireEye warned of the new attacks by the Shamoon virus on Wednesday.
They did not name any victims of the new version, which cripples computers by wiping their master boot records that they use to start.
FireEye said in a blog post its Mandiant unit "has responded to multiple incidents at other organisations in the region".
The reappearance of Shamoon is significant as there have only been a handful of other high-profile attacks involving disk-wiping malware, including ones in 2014 on Sheldon Adelson's Las Vegas Sands Corp and Sony Corp's Hollywood studio.
Governments and businesses pay close attention to such cases because it can be time-consuming and extremely expensive to restore infected systems.
The original Shamoon hackers left images of a burning US flag on machines at Saudi Aramco and RasGas in 2012.
Researchers said the Shamoon 2 hackers also left a calling card: a disturbing image of the body of three-year-old Syrian refugee Alan Kurdi, who drowned in the Mediterranean in 2015.
The 2012 Shamoon attacks were likely conducted by hackers working on behalf of the Iranian government, CrowdStrike chief technology office Dmitri Alperovitch said.
It is too early to say whether the same group was behind Shamoon 2, he said.
The motive of the recent attacks was also not immediately clear.
Share
