Cutting Sword of Justice

Cutting Sword of Justice is the name used by the actors who claimed responsibility for the August 15, 2012 destructive malware attack against Saudi Aramco. In the reporting provided, the group presented itself as an activist or hacktivist group angered by Saudi policies in the Middle East and said the operation was retaliation for what it described as oppressive measures. The group claimed its malware destroyed about 30,000 Saudi Aramco computers, roughly three-quarters of the company’s systems, and posted alleged infected IP addresses on Pastebin as proof. It also threatened a follow-on attack. The attack is repeatedly associated in the content with Shamoon, also referred to as Disttrack, a destructive wiper that erased data and rendered systems unusable. Reporting cited in the content states the malware wiped documents, spreadsheets, and emails, and replaced files with an image of a burning American flag. Saudi Aramco isolated its electronic systems from outside access and shut down internal corporate services to contain the incident; the content states production systems were not affected because office systems were segregated from production-control systems. The content also links the name Cutting Sword of Justice to later reporting on Shamoon 2.0 in 2016, describing it as a reworked version of the 2012 Shamoon malware. That reporting says the malware used embedded privileged credentials, propagated laterally via administrative shares, enabled Remote Registry, modified LocalAccountTokenFilterPolicy, copied itself to remote systems, scheduled execution, and then wiped systems at a hard-coded time. Multiple sources in the content describe Cutting Sword of Justice as a suspected Iranian attacker group or state-linked actor, and some reporting says U.S. intelligence officials assessed Iran was the real perpetrator of the Aramco attack, possibly in retaliation for Stuxnet. However, the same content also notes that public claims under the Cutting Sword of Justice name may have been deceptive or a red herring, and that specific evidence was not provided in those reports. High-confidence aliases directly supported by the content are limited to "Cutting Sword of Justice."