 In our research, we’re able to outline that Shamoon 2 enters and spreads through an organization in three stages:  These stages are outlined in the image below.  And that credential theft is a key element in each stage:  It’s also worth noting that credentials are a keystone issue in Shamoon 2 wave 2 too: we saw evidence of targeting an organization’s virtual desktop infrastructure (VDI) solutions with default credentials.