The DOI matches its Crossref record.
Overview of Cyberattack on Saudi Organizations
Open accessAbstract
The beginning of Twenty first century saw a new dimension of security, the cybersecurity. Developed countries have started exploiting the vulnerabilities of cybersecurity to gain supremacy and influence over the rival countries. Hence, over the past decade, malware, i.e., malicious software, has become a major security threat in regards to the cybersecurity. The Kingdom of Saudi Arabia (KSA) has become a major target of cyber conflicts due to increased economic activity, digital transformation, high rate of technology adoption between citizen and organizations and rise of the oil and gas industry. However, unfortunately, there is a lack of research or scientific investigation of cyberattacks on KSA. This fact motivated us in conducting this work. This paper presents, a case study of attacks on Saudi Organization by malwares. We concentrate on two particular malwares: Shamoon and Ransomware. The timeline of attacks by these malware, also presented, along with their structures and methodologies in order to shield ourselves against similar attacks in the future.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“The number of reported incidents began to increase dramatically after the year 2000, i.e. when SCADA systems able to communicate via TCP/IP protocol were introduced [169].”
From SCADA Systems With Focus on Continuous Manufacturing and Steel Industry: A Survey on Architectures, Standards, Challenges and Industry 5.0 (2022) · cites this paper as [169]
In the citing paper
“As a result, multiple surveys, reviews and systematic literature overviews have been published covering the domain of security within I4.0, CPS, ICS, SCADA systems and the manufacturing industry in general, providing insight into the security risks and implementation of digital security measures in these environments [169], taxonomy of attacks [173], [174] and security standards developed for SCAD”
From SCADA Systems With Focus on Continuous Manufacturing and Steel Industry: A Survey on Architectures, Standards, Challenges and Industry 5.0 (2022) · cites this paper as [169]
Citations
Cited by
Internet of things and ransomware: Evolution, mitigation and prevention
Humayun, M., Jhanjhi, N. Z., Alsayat, A., & Ponnusamy, V. (2020) · Egyptian Informatics Journal · doi:10.1016/j.eij.2020.05.003 · Cited by 210
“One of the most publicized attacks by mamba in the year 2016 was the public transport system of San Francisco, it also targeted the corporate network of KSA in 2017 [64,65].”
BackgroundANGEL: An Intelligent Digital Twin Framework for Microgrid Security
Danilczyk, W., Sun, Y. L., & He, H. (2019) · North American Power Symposium (NAPS) · doi:10.1109/naps46351.2019.9000371 · Cited by 127
“The importance of the power grid coupled with the fact that malicious and state-sponsored cyberattacks are on the rise worldwide [14] makes the power grid a high value target”
BackgroundSverko, M., Grbac, T. G., & Mikuc, M. (2022) · IEEE Access · doi:10.1109/access.2022.3211288 · Cited by 71
“…of ICS and SCADA systems was not considered a global issue until the discovery of the Stuxnet worm, developed in 2010 with the specific purpose of targeting ICS [168], and two years later, the Shamoon virus responsible for the attack on Saudi Aramco, the world’s largest oil company [169], [170].”
BackgroundEvolution of Malware Threats and Techniques: a Review
Alenezi, M. N., Alabdulrazzaq, H., Alshaher, A. A., & Alkharang, M. M. (2022) · International Journal of Communication Networks and Information Security (IJCNIS) · doi:10.17762/ijcnis.v12i3.4723 · Cited by 85
Limiting the Undesired Impact of Cyber Weapons: Technical Requirements and Policy ImplicationsPreprint
Bellovin, S. M., & Lin, H. S. (2016) · SSRN Electronic Journal · doi:10.2139/ssrn.2809463 · Cited by 43
Al-Somali, S. A., Saqr, R. R., Asiri, A. M., & Al-Somali, N. A. (2024) · Sustainability · doi:10.3390/su16051880 · Cited by 45
Evolution of Malware Threats and Techniques: a Review
Alenezi, M. N., Alabdulrazzaq, H., Alshaher, A. A., et al. (2020) · International Journal of Communication Networks and Information Security (IJCNIS) · doi:10.54039/ijcnis.v12i3.4723 · Cited by 29
“It is also believed that the US and Israeli secret services are behind it [7, 60].”
BackgroundSingh, H. P., & Alshammari, T. (2020) · Beijing Law Review · doi:10.4236/blr.2020.113039 · Cited by 33
Zombie Awakening: Stealthy Hijacking of Active Domains through DNS Hosting Referral
Alowaisheq, E., Tang, S., Wang, Z., et al. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3417864 · Cited by 24
“The selection of SA domains was made due to the massive increase of attacks recently targeting Saudi Arabian services [3, 54, 66].”
BackgroundRansomware Attack on the Educational Sector
Butt, U., Dauda, Y., & Gutappa, B. S. (2023) · Advanced sciences and technologies for security applications · doi:10.1007/978-3-031-33627-0_11 · Cited by 14
Cyberattacks Against Critical Infrastructure Facilities and Corresponding Countermeasures
Vähäkainu, P., Lehto, M., & Kariluoto, A. (2022) · Computational methods in applied sciences · doi:10.1007/978-3-030-91293-2_11 · Cited by 12
Understanding and Classifying Permanent Denial-of-Service Attacks
Abaimov, S. (2024) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp4020016 · Cited by 11
“While the most widely used example of PDoS malware is BrickerBot [5], this research surveyed other known malware and malware strains, for example, TDL4 [3], StoneDrill [1], Mamba [6], Remaiten [7], Bad Rabbit [4], Silex, PaperW8 [8], and more.”
BackgroundMethodAlimi, O. A. (2025) · Technologies · doi:10.3390/technologies13050176 · Cited by 13
Cyber-attacks on Saudi Arabia Environment
Al-Mulhim, R. A., Al-Zamil, L. A., & Al-Dossary, F. M. (2020) · International Journal of Computer Networks and Communications Security · doi:10.47277/ijcncs/8(3)1 · Cited by 10
“[1] On the other hand, Mamba ransomware is considered a kind of ransomware that attacked KSA and the internal networks and it encrypted the full disk by using legitimate DiskCryptor powerful tool.”
BackgroundInfluentialVulnerabilities and Cyberspace: A New Kind of Crises
van den Berg, B., & Kuipers, S. (2022) · Oxford University Press eBooks · doi:10.1093/acrefore/9780190228637.013.1604 · Cited by 15
Alhejaili, M. O. M. (2024) · Journal of Governance and Regulation · doi:10.22495/jgrv13i2siart4 · Cited by 12
Zaabi, S. H. A., & Zamri, R. (2022) · Sustainability · doi:10.3390/su142214915 · Cited by 8
Cyber Threat Intelligence in Risk Management
Aljuhami, A. M., & Bamasoud, D. M. (2021) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2021.0121018 · Cited by 6
“The study [20] also presented a case study on attacks against Saudi Arabia and focused on two types of malwares: ransomware and Shamoon.”
BackgroundInfluentialA Novel Approach to Get Awareness in Saudi Arabia Regarding Phishing Attacks
Aljumah, Y., & Ahmed, S. S. (2021) · International Conference on Electrical, Communication, and Computer Engineering (ICECCE) · doi:10.1109/icecce52056.2021.9514206 · Cited by 5
The Extent to which Individuals in Saudi Arabia are Subjected to Cyber-Attacks and Countermeasures
Alzahrani, A. A. H. (2020) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2020.0110240 · Cited by 5
“However, there is an insufficient of research or scientific investigation of cyberattacks on Saudi Arabia [10].”
BackgroundSecurity-Based Safety Hazard Analysis Using FMEA: A DAM Case Study
Inayat, I., Farooq, M., Inayat, Z., et al. (2021) · Communications in computer and information science · doi:10.1007/978-3-030-87101-7_3 · Cited by 4
“However, risk assessment and analysis are not addressed in BDMP. STPA-SafeSec claims that security has an impact on safety and demonstrates its evaluation through a causal model [13].”
BackgroundDiab, M. F. S., Al-Shammar, M. B. S., & Mohamed, G. S. K. (2025) · Journal of Money Laundering Control · doi:10.1108/jmlc-07-2024-0110 · Cited by 4
Analyzing WhisperGate and BlackCat Malware: Methodology and Threat Perspective
Nicho, M., Yadav, R., & Singh, D. (2023) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2023.0140456 · Cited by 3
“WhisperGate is classified as a wiper, i.e., it disguises itself as ransomware but instead aims to cause mass destruction by wiping out hard drives at targeted organizations [10].”
BackgroundImpact of Cyber Attack on Saudi Aramco
I.alghamdi, M. I. (2021) · Journal of Cybersecurity and Information Management · doi:10.54216/jcim.070102 · Cited by 2
Frequent occurring forms of internet frauds
Milošević, Đ. (2022) · Bastina · doi:10.5937/bastina32-35814 · Cited by 2
Testing a rich sample of cybercrimes dataset by using powerful classifiers’ competencesPreprint
Zayid, E. I. M., Humayed, A. A., & Adam, Y. A. (2024) · doi:10.36227/techrxiv.170491687.71856965/v1 · Cited by 2
Social engineering awareness and resilience in Egypt: a quantitative exploration
Shehata, A. M. K., & Eldakar, M. A. M. (2024) · Library Hi Tech · doi:10.1108/lht-10-2023-0480 · Cited by 1
Protection of Critical Digital Infrastructure
Dinçel, Y. (2025) · IGI Global eBooks · doi:10.4018/979-8-3373-7406-2.ch007 · Cited by 2
Alhayani, S., & Murphy, D. R. (2023) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2023.038003 · Cited by 1
Security-based Safety Hazard Analysis using STAMP, STPA & HAZOP: A DAM Case Study
Farooq, M., Inayat, I., & Daneva, M. (2023) · International Conference on Frontiers of Information Technology (FIT) · doi:10.1109/fit60620.2023.00012 · Cited by 1
Resilient infrastructures in the AnthropocenePreprint
Manrique, G., Dupont, B., & Shearing, C. D. (2022) · CrimRxiv · doi:10.21428/cb6ab371.040fb9d1
WiDeS: Wiping Detection using System-calls - An Anti-Forensic Resistant Approach
Sanda, P., Pawar, D., & Vedala, R. (2023) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom60117.2023.00231
“In 2012 and 2017, Saudi Arabian critical infrastructure government organizations and energy sectors were attacked by wiper tools [5] [6].”
BackgroundKreso, I. (2025) · Applied Cybersecurity & Internet Governance · doi:10.60097/acig/211124 · Cited by 4
Human-centered cybersecurity risk management for IT/OT-converged oil and gas operating facilities
Imran, H., Turner, C., Nassar, S., Tran, Y., & Salama, M. (2026) · Computers & Security · doi:10.1016/j.cose.2026.104918
The Role of Digital Forensics in Protecting Critical Energy Infrastructure from Cyberattacks
Kreso, I. (2026) · CONTEMPORARY MILITARY CHALLENGES · doi:10.2478/cmc-2026-0019
Metadata
- Authors
- Alelyani, S., & Kumar G R, H.
- Affiliations
- King Khalid University (SA)
- ORCID
- Alelyani, Salem
- Venue
- Journal of Information Security and Cybercrimes Research
- Published
- 2018
- ISSN
- 1658-7782 (ISSN-L)
- 1658-7790
- OpenAlex
- W2802525389
- Cited by
- 37
- References
- 0
- Citations by year
- 2026: 2 · 2025: 4 · 2024: 6 · 2023: 5 · 2022: 7 · 2021: 4 · 2020: 7 · 2019: 1
- FWCI
- 2.15
- Type
- journal article
- Language
- en
- Open access
- diamond
- doi.org
- Licence
- cc-by-nc
- Locations
- Journal of Information Security and Cybercrimes Research (publishedVersion, cc-by-nc)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Software › Advanced Malware Detection Techniques
- Social Sciences › Political Science and International Relations › Cybersecurity and Cyber Warfare Studies
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- cyberattacks, malware, ransomware, Saudi Arabia, oil and gas industry, cyber conflict, cyber threats
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
