A Cybersecurity Architecture to Mitigate Shamoon Attacks

Shamoon attacks are one of the most recent Advanced Persistent Threat (APT) attacks that is being used against several organizations in the energy sector in Saudi Arabia. It is a very destructive malware that corrupts files on the targeted computer and overwrites the Master Boot Record (MBR) to render a computer unusable. In this paper, we propose an enhanced cybersecurity architecture that helps in the effort of halting the chain of attack at any stage and mitigate Shamoon attacks. Before that, we analyze the historical, tactical, and technical aspects of the Shamoon attacks. Our analysis explores the various methods of attack and the different stages through which the attackers achieve their penetration to the targeted organization network. By conducting such analysis, we reveal the weaknesses of the cybersecurity architecture that were exploited by the attackers.