Aramco Hacker: Iranian or Romanian?

The New York Times on the Saudi Aramco hacking attack:

That morning, at 11:08, a person with privileged access to the Saudi state-owned oil company’s computers, unleashed a computer virus to initiate what is regarded as among the most destructive acts of computer sabotage on a company to date. The virus erased data on three-quarters of Aramco’s corporate PCs — documents, spreadsheets, e-mails, files — replacing all of it with an image of a burning American flag.

The Times story provides some interesting details about the attack and the company’s response. According to the paper, US intelligence officials claim Iran is behind the attack, but they did not offer any specific evidence to support that claim. This contradicts Saudi local media reports. Earlier this month, al-Hayat quoted unnamed Aramco sources who said the hacker, based in Romania, was working for a third party in a Western European country.