While the identity of the people behind the Aramco attack remains a mystery, one clue was given by the creators of the Shamoon malware. Within the code, Kaspersky Labs experts found a fragment of a picture of a burning US flag — hinting at a possible political motivation. However the fragment was hidden in plain sight so to speak and was there to be found according to the experts investigating the malware, meaning it could be something of a red herring.
While a group called the Cutting Sword of Justice has claimed responsibilty, another security expert, Sean Sullivan from F-Secure, believes there is no credible reason for believing their claims.
"Just like last week's claim that the Apple UDID debacle lies at the FBI's door, the latest conspiracy theory that the previously unknown 'Cutting Sword of Justice' are behind attacks on Saudi Aramco is completely unsubstantiated.“
“There is no evidence linking the group to this highly devastating attack, which is as likely to be an inside job as it is the work of industrial competitors looking to influence oil prices.,”"