Dustman
Dustman is a destructive wiper malware in the Iranian wiper ecosystem and is described as a variant or successor closely related to ZeroCleare. Public reporting in the provided content states that Dustman was identified as a new variant similar to ZeroCleare and that both families mirrored Shamoon’s use of modified legitimate drivers to achieve destructive effects. The malware is tied in the content to Iranian state-aligned activity, particularly APT34/OilRig, and is also referenced more broadly as part of Iran’s arsenal of more than 15 wiper families. Dustman was reportedly deployed heavily against energy and industrial sector targets, including Saudi energy-sector targeting, and is mentioned alongside operations affecting Bahrain’s Bapco in late 2019 and early 2020. The content further notes that infrastructure associated with the Fox Kitten campaign could potentially be used to spread and activate destructive malware such as ZeroCleare and Dustman. High-confidence behavioral detail in the provided material is limited, but the core described capability is destructive wiping using modified legitimate drivers in a manner similar to Shamoon/ZeroCleare. No specific indicators of compromise are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“...it can also be used as a platform for spreading and activating destructive malware such as ZeroCleare and Dustman, tied to APT34.”
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A successor to ZeroCleare, Dustman is a destructive wiper that uses modified legitimate drivers to achieve destructive effects.
An Iran-linked wiper malware family mentioned as part of a set of destructive tools designed to wipe data and disrupt operations.
Destructive wiper malware family referenced as part of Iran-aligned wiper tooling.
A Zerocleare-like destructive wiper variant assessed as prepared for deployment in targeted attacks, with indications of focus on Saudi Arabia’s energy sector.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.