How Seculert Discovered the Shamoon Malware © 2013 Seculert Company, All Rights Reserved

Shamoon is a 2-stage attack targeting Oil & Energy companies Shamoon Targeted Attack Shamoon is a 2-stage attack targeting Oil & Energy companies Comprised of 3 modules Dropper Reporter Wiper Extracting data via an internal infected machine proxy Shamoon stages Data extraction Wiping machines Internal proxy used for both Dropper and Reporter. Worm capabilities to spread itself, by trying to create a scheduled task on remote LAN machines. © 2013 Seculert Company, All Rights Reserved #seculertjuly2013

Spreading itself on the local network via Scheduled Tasks Shamoon Targeted Attack Spreading itself on the local network via Scheduled Tasks Abuse a legitimate & signed RawDisk driver to wipe MBR Wiper module Time Bomb Wipe drive and MBR at specified dates and times Others copycat this capability Creating scheduled tasks on remote machines on the local network Eldos signed Internal proxy used for both Dropper and Reporter. Worm capabilities to spread itself, by trying to create a scheduled task on remote LAN machines. © 2013 Seculert Company, All Rights Reserved #seculertjuly2013

Initial attack vector is still unknown Shamoon – Why It Wasn’t Prevented Initial attack vector is still unknown Physical access / Insider Partner Spear phishing Time based attack (time bomb) Worm spreading in local network Using local machine as a proxy Most of the victim companies were using solutions which are focused on prevention © 2013 Seculert Company, All Rights Reserved #seculertjuly2013 4

A customer uploaded a suspicious file to the Seculert Elastic Sandbox How Seculert Identified Shamoon A customer uploaded a suspicious file to the Seculert Elastic Sandbox Malware behavioral profile was automatically created Shamoon was detected on another customer using Big Data analysis of their gateway traffic logs Customers use Seculert API to enhance their on-premises security devices to protect against Shamoon © 2013 Seculert Company, All Rights Reserved #seculertjuly2013 5

From Prevention to Protection Persistent attacks require a new approach Big Data analytics Long-term analysis Advanced malware profiling Automated expertise © 2013 Seculert Company, All Rights Reserved #seculertjuly2013 6

© 2013 Seculert Company, All Rights Reserved Let Seculert Detect Unknown Malware on Your Network Sign-up Now Immediate Results – No Credit Card Required – Initial Results are FREE! © 2013 Seculert Company, All Rights Reserved