During security incidents due to malware infections, it is required to act fast and identify the malware behavior and take actions. However analyzing malware may takes time ,especially if considering that antiviruses cannot detect new well-crafted malwares.
To quickly analyses a suspicious file to identify if it a malware or not and understand its behavior, the following quick actions can be taken
A new research by GData Software researchers, Identified a C&C server for a botnet hidden in TOR network.
Their blog is excellent where they described the 2 C&C traffic medias are being used by Botnets and the new media using TOR. I highly recommend reading it and establish an approach to detect and stop such traffic.
Always remober because you are responsible for an evidence, it means you have to show "chain of custody" by following proper procedure and protect the integrity of an evidence all the way to its dispostion.
remote offices of company "X" in another GCC state "H" got infected
Service provider "A" managing the remote office became infected
Same Service provider "A" managing few of the GCC state "H" government entities became infected then infect other gov entities.
Of course it will be a chain of infections and network shutdowns.
Seems crazy, but think about it as if you are another state has serious issues with GCC and you already has the technology, the skills and the code. if you can do it 2 times then hardly you will be stopped.
Answer: It is RASGas in Qatar whom has experienced virus outbreak, the computers network has been taken off for 3 days ,so far, by unknown virus. but let me guess, it can be shamoon or one of his cousins.
ARAMCO at KSA, RASGas at Qatar, will UAE be the next ? specially with remote offices around the GCC ?
Making Life Difficult for Malware is presentation by Jarno Niemelä from F-Secure, it is very practical and i highly recommend it.
Jarno listed recommendations based on a research of the behavior data of ~750000 known malware. Most of the recommendations cost zero dollar and can be implemented easily by any type of organizations using minimal resources.