Shamoon, also known as Disttrack, was first spotted in a wave of attacks that targeted companies in Saudi Arabia in 2012. The principal capability of Shamoon is a feature that allows it to wipe data from hard drives of infected systems. Shamoon 2 attacks leveraged credentials stolen by hackers of the Greenbug group, Symantec researchers believe. The attacks took place on Lailat al Qadr, the holiest night of the year for Muslims; another time the attackers could be reasonably certain employees would not be at work. In the attack against Saudi Aramco Shamoon wipe data on over 30,000 computers and rewrite the hard drive MBR with an image of a burning US flag.”]
Source: https://securityaffairs.co/wordpress/55634/cyber-crime/shamoon-2-greenbug.html