{"id":59922,"date":"2025-09-26T10:55:34","date_gmt":"2025-09-26T10:55:34","guid":{"rendered":"https:\/\/becolve.com\/blog\/a-new-shamoon-campaign-with-disttrack\/"},"modified":"2025-09-26T10:55:34","modified_gmt":"2025-09-26T10:55:34","slug":"a-new-shamoon-campaign-with-disttrack","status":"publish","type":"blog","link":"https:\/\/becolve.com\/en\/blog\/a-new-shamoon-campaign-with-disttrack\/","title":{"rendered":"A New Shamoon Campaign with Disttrack"},"content":{"rendered":"

 <\/p>\n

A new variant of the Disttrack malware<\/strong> (W32.Disttrack.B<\/strong>) has reappeared this month, affecting different companies in the Oil & Gas sector, within the well-known Shamoon campaign.<\/p>\n

In this case, Disttrack acts as a worm\/trojan\/file eraser. In other words, the malware is capable of massively infecting computers located on a specific local network, and once infected, it first proceeds to \u201cclean-erase\u201d (wiper) the files found on said computer, and then rewrite its MBR (Master Boot Record). <\/p>\n

The most recent attack targeted an Italian oil and gas drilling company operating in the Middle East and affected approximately 300 servers and 100 PCs.<\/p>\n

This type of attack and behavior (infection, deletion of equipment, and file substitution) is very characteristic of the Shamoon campaign. We can recall how between 2012 and 2016, along with the Duqu and Flame campaigns, Shamoon carried out sabotage, information theft, and industrial espionage actions against companies in the Oil&Gas sector, such as Saudi Aramco or Qatar’s RasGas. It is estimated that, at that time, between 30,000 and 50,000 workstations of these companies were overwritten. <\/p>\n

Disttrack consists of three components:<\/b><\/p>\n