The Shamoon malware is believed to have been involved in the first attack

Aug 24, 2012 07:01 GMT  ·  By

On August 15, a group of hackers attacked the systems of Saudi Aramco – one of the world’s largest oil companies. According to a new statement released by the attackers, the organization will be targeted once again on August 25, 2012, at 21:00 GMT.

However, the story is far more complicated than it appears. First of all, it’s unknown who the hackers are. At least two groups have taken credit for the attacks: Arab Youth Group and the Cutting Sword of Justice.

Furthermore, while the company claims that the damage has been contained and that the disruption had no effect on production operations, the hacktivists say that their actions damaged around 30,000 computers. They even published the range of IPs allegedly affected by their attack.

In recent statements, the hackers revealed that Saudi Aramco suspects that the attack was supported by someone from the inside.

These suspicions might be related to the fact that a number of employee passwords have been published online, along with password reset confirmation emails.

On the other hand, it’s believed that the campaign has relied on the recently uncovered Shamoon Trojan and distributed denial-of-service attacks.

Now, the hackers want to “charge their lazors” at Saudi Aramco once again to demonstrate to the world that they have “the ability to do more.”

“We are going to make it, next week, once again, and you will not be able by 1% to stop us. That will happen for two reasons: 1 - you're brutal and selfish to harm any employee just for the sake of expecting, 2- we do hate, hate a lot, arrogance,” they said.

The date appointed by the hacktivists is almost here and it will be interesting to see if the oil giant manages to defend its infrastructure now that it knows when to expect an attack.