The Shamoon operators are the Iran-assessed destructive cluster behind the Disttrack wiper, responsible for the landmark 2012 Saudi Aramco attack that destroyed ~30,000 workstations, and for renewed 2016-2017 and 2018 wiper waves against Saudi and Gulf government and energy organizations.
Shamoon (the Disttrack wiper) first struck in August 2012, devastating Saudi Aramco and RasGas, and was documented by Symantec, McAfee, and others. It is best understood as a destructive campaign/tool cluster rather than a single fixed group: multiple Iranian actors have been tied to delivery and enablement across its waves, including Greenbug (credential harvesting) and links to APT33 and OilRig tradecraft. Attribution to Iran is medium-high confidence, resting on victimology, timing around Iran-Saudi tensions, and technical/enabler overlaps, though no single vendor promotes a unified MITRE Group ID for the operators (Shamoon is catalogued as malware).
The operations are defined by pure destruction with political messaging: Disttrack overwrites the Master Boot Record and files with garbage or ideological images (a burning U.S. flag in 2012; a photo of Alan Kurdi in 2016), rendering machines unbootable. Access and credentials were typically pre-staged — Greenbug-style credential theft preceded the 2016-2017 'Shamoon 2' wave — before coordinated, scheduled wiper detonation for maximum simultaneous impact.
MENA and the Gulf are the exclusive theater. Saudi Arabia bore the brunt across all waves — energy, petrochemical, and government organizations — with additional Gulf victims; the 2018 activity (linked to an Italian oil-services firm's Middle East operations) extended the pattern. The attacks are widely regarded as a milestone in state-sponsored destructive cyber operations.
No new Shamoon/Disttrack wave has been publicly reported since 2018, so the cluster is assessed as dormant, though the Iranian destructive mission it pioneered continues through Agrius, Void Manticore, and Moses Staff. It is included as a foundational destructive-operations historical entry.