Because I'm bad, I'm bad, Shamoon: PC wiper tried to shut down Saudi snapshot defences

Bah!

I can think of more likely culprits than Iran, state actors with "form", if the spin I'm gtting is in any way, shape or form some approximation of the truth.

I'll wait over here wearing the pointy hat until you all stop laughing.

So the attackers are using credentials they presumably stole in their first attack. Are they really expecting that Saudi Aramco wouldn't change all their passwords? They did change all their passwords right?

Gone in 60 seconds

My impression of Saudi security is that any contact with their email systems results in a maniac amount of spam arriving within days, not weeks. This suggests to me that their entire network is infested with malware at a simple commercial spam/hack level so what it looks like to a nation-state level attack I dread to think.

When will people learn?

SNAPSHOTS. ARE. NOT. BACKUPS.

The only thing that should be considered a proper backup is data that has been written to WORM media and has been confirmed good, anything else is worthless for the purpose of backing things up.

While we're at it, RAID is not backup, neither is Disk-to-Disk (useful as -part- of a backup system, but should never be the sole backup strategy).

VDI = Virtual Disc Image

Why do the Americans still insist on blaming Iran for everything? There has been no conclusive proof that Iran have been behind any of these 'attacks'. And, despite what they would have you believe not one single Islamic Terrorist attacking the good ol' US of A has come from Iran.

Isreal on the other hand, they love some cyber warfare, attacking Iran as they did with Stuxnet and as for Saudi Arabia, they actually breed terrorists.