MILAN/NEW YORK, Dec 12 (Reuters) - A hack on Italian oil services firm Saipem that crippled more than 300 computers was likely caused by a variant of a notorious destructive virus known as Shamoon, the company and two cybersecurity firms said.
Saipem’s head of digital and innovation, Mauro Piasere, told Reuters on Wednesday that the firm suspects that a Shamoon variant caused between 300 to 400 computers to stop working in an attack that was disclosed by the company on Monday and primarily affected its servers in the Middle East.
Piasere said the company does not know who was behind the attack.
Use of a Shamoon variant would be significant because related viruses have been used in some of the most damaging attacks in history, beginning in 2012 when it crippled tens of thousands of computers at Middle Eastern energy firms Saudi Aramco and RasGas Co Ltd.
Shamoon resurfaced again in late 2016 in a series of attacks in the Middle East that continued through early 2017, and then went dormant.
“It went dark for a long time and it seems to be back,” said Symantec senior researcher Eric Chien. “The question is whether any others were affected by it.”
Security researchers widely believe that people working on behalf of the Iranian government were behind the previous Shamoon attacks, something that Tehran strongly denies. Anti-U.S. imagery was found in the code, researchers have said.
CrowdStrike Vice President of Intelligence Adam Meyers said early technical analysis of the Saipem hack showed similarities with Shamoon and that it was likely Iran was also responsible, though the specific motive was not immediately apparent.
Officials in Iran could not be reached for comment.
Shamoon disables computers by overwriting a crucial file known as the master boot record, making it impossible for devices to start up. Former U.S. Defense Secretary Leon Panetta has said the 2012 Shamoon hack on Saudi Aramco was probably the most destructive cyber attack to date on a private business.
Saudi Aramco is the biggest client of Saipem, one of the world’s largest subsea engineering and construction firms, which is controlled by Italian state lender CDP and oil firm Eni .
The Saipem attack knocked out more than 300 servers and dozens of personal computers in Saudi Arabia, the United Arab Emirates, Kuwait, India and Scotland, Piasere said.
No data will be lost because the company had backed up the computers that were affected, he said.
Servers are slowly being brought back on line, though the company is proceeding carefully to prevent further infections, he added. (Reporting by Stephen Jewkes in Milan and Jim Finkle in New York Additional reporting from the Dubai newsroom, Editing by Rosalba O’Brien)
Our Standards: The Thomson Reuters Trust Principles.