In August 2012, a politically charged cyber assault shook the oil giant Saudi Aramco, wiping out data on 35,000 workstations. The attack, attributed to the notorious APT33 group, showcased a sophisticated MBR overwriting mechanism and left behind the telling image of a burning American flag. Investigators must dissect this complex attack, understanding the timing, motives, and techniques employed by the attackers.