Italian energy company Saipem was hit by a new variant of the notorious Shamoon disk-wiping malware, which attacked Saudi Arabian oil giant Aramco in 2012
Eduard Kovacs / SecurityWeek :
Context & Ripple Effects
Shamoon is back: six years after the disk-wiper hit Saudi Aramco, a new variant has struck Saipem, an Italian contractor whose business sits inside the same Gulf energy ecosystem. The strike lands amid a documented run of destructive attacks on Saudi petrochemical targets — sources last spring described [[a:927649|hacks of Saudi petro firms intended to trigger an explosion via compromised Schneider Electric controllers]], and in October FireEye tied the Triton malware that shut down a Saudi petrochemical plant to a Russian government-owned research institute.
First-order effects
- Saipem must rebuild wiped IT systems while assessing whether project and client data for its energy customers was destroyed or exposed alongside them.
- Energy companies that rely on contractors like Saipem now have to treat their suppliers' networks as an attack surface for destructive, not just espionage, operations.
Second-order effects
- The revival of a known wiper pushes oil and gas operators to demand stricter IT/OT segmentation and incident guarantees from engineering contractors, raising compliance costs across the supplier base.
- Security vendors and insurers serving the energy sector gain leverage to reprice risk, as two state-linked destructive campaigns — Shamoon and Triton — now bracket the same industry within two years.
Third-order effects
- If disk-wiping variants keep resurfacing against energy infrastructure, destructive attacks shift from one-off sabotage events to a recurring feature of geopolitical conflict, likely drawing regulators deeper into mandating cyber standards for critical-industry contractors.
The trend: Destructive malware is re-emerging as a state-aligned tool against the energy sector, extending an arc that runs from the 2012 Aramco attack through the 2017 Triton incident to today's Saipem hit.