QUADAGENT

Executive Summary

OilRig’s QUADAGENT is a PowerShell backdoor that establishes persistence and facilitates remote command execution while exfiltrating data from compromised Windows machines. Its use of legitimate OS components helps it evade many signature‑based defenses, making behavioral detection critical. The tool frequently serves as a pivot in larger OilRig campaigns targeting industrial control systems and other high-value infrastructure.

QUADAGENT is a PowerShell‑based backdoor attributed to the APT group known as OilRig (also referred to as APT 38). The tool deploys itself on compromised Windows systems, establishing persistence through either a scheduled task or a malicious service entry in the registry. Once resident, QUADAGENT communicates with its command and control (C2) server via obfuscated PowerShell scripts that are typically embedded within the binary or delivered as base64‑encoded payloads. The backdoor facilitates remote code execution and data exfiltration. It can enumerate system information, harvest credentials from memory or local files, and download additional modules to expand its capabilities—such as lateral movement tools exploiting Windows administrative shares or further PowerShell scripts for persistence. In many documented incidents, OilRig leveraged QUADAGENT to collect intelligence on critical infrastructure networks and pivot into deeper segments of the target environment. Operationally, QUADAGENT exhibits classic APT behavior: minimal footprint, encrypted network traffic, and use of legitimate Windows components (PowerShell, WMI, registry). Detection typically relies on behavioral monitoring rather than signature‑based methods because the tool eschews known malware binaries in favor of custom scripts.

Key Capabilities

• Persistence via scheduled tasks or registry run keys
• Remote command execution using obfuscated PowerShell scripts
• C2 communication over HTTP/HTTPS with encrypted payloads
• Data exfiltration of files, credentials, and system info
• Lateral movement through Windows administrative shares and WMI
• Privilege escalation via exploitation of local service accounts
• Stealth by embedding scripts in base64 form or within legitimate binaries

ATT&CK Techniques

Recommended Actions

• Deploy behavioral baseline detection that flags unusual PowerShell invocation patterns, especially with obfuscated or encoded commands
• Implement strict application whitelisting to block unauthorized script execution
• Monitor for new or modified scheduled tasks and registry entries under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• Restrict outbound HTTP/HTTPS traffic to known C2 IPs or domains where possible
• Leverage EDR solutions with PowerShell module detection and real‑time analysis
• Conduct regular credential hygiene reviews and enforce MFA for privileged accounts
• Use network segmentation and monitor for anomalous SMB/LAN share activity

Suggested Tags