Italian energy company Saipem was hit by a new variant of the notorious Shamoon disk-wiping malware, which attacked Saudi Arabian oil giant Aramco in 2012
Italian oil and gas services company Saipem has confirmed that its systems were hit recently by a new variant of the notorious Shamoon malware.
Context & Ripple Effects
Saipem's confirmation that a new Shamoon variant hit its systems revives a malware family best known for the 2012 disk-wiping assault on Saudi Aramco, and lands just months after sources described [[a:927649|2017 hacks of Saudi petrochemical firms intended to trigger an explosion through compromised Schneider Electric controllers]].
The timing matters because FireEye had only weeks earlier attributed the Triton malware that shut down a Saudi petrochemical plant to a Russian government-owned research institute — meaning destructive attacks on energy infrastructure are now arriving roughly annually, from multiple actors, rather than as one-off events.
First-order effects
- Saipem, an oil and gas services contractor, must rebuild wiped machines and investigate how far the infection spread across its IT estate, while its energy-major clients face exposure through a compromised supplier network.
Second-order effects
- Energy operators and their contractors — the same supply chain Aramco later blamed when 1TB of its data surfaced for sale on the dark web — come under pressure to harden vendor access, pushing security requirements into service contracts and procurement terms.
Third-order effects
- If destructive variants keep resurfacing against industrial targets — Shamoon in 2012, the Schneider controller sabotage plot in 2017, Triton's Russian-attributed shutdown — energy infrastructure shifts toward treating disk-wiping and safety-system attacks as a recurring operational hazard, not an anomaly, inviting regulatory scrutiny of critical-infrastructure cyber defenses.
The trend: Destructive malware against energy and industrial infrastructure is becoming a recurring, multi-actor campaign — new variants years apart rather than isolated incidents.