Threat Actors OilRig

OilRig

G0049 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: COBALT GYPSY, IRN2, APT34, Helix Kitten, Evasive Serpens, Hazel Sandstorm, EUROPIUM, ITG13, Earth Simnavaz, Crambus, TA452, Twisted Kitten, Chrysene, APT 34, ATK40, G0049, OilRig, Greenbug, TG-2889, Ghambar, Cutting Kitten, ITsecTeam, SOLAR ION

Description

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.(Citation: FireEye APT34 Dec 2017)(Citation: Palo Alto OilRig April 2017)(Citation: ClearSky OilRig Jan 2017)(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)(Citation: Unit42 OilRig Playbook 2023)(Citation: Unit 42 QUADAGENT July 2018)

Goals & Targeting

Targeted Sectors

Energy

Government

Targeted Countries / Regions

AI Analysis

· 2 months ago

Executive Summary

OilRig is a suspected Iranian threat group that has been active since at least 2014, primarily targeting energy and government sectors in the Middle East and internationally. Their motivations appear to be espionage-driven, leveraging supply chain attacks to compromise their targets. The group's operations align with nation-state interests, utilizing Iranian infrastructure and referencing Iran in their tactics.

Goals & Targeting

OilRig's strategic objectives appear to be strongly aligned with the interests of the Iranian government, focusing on sectors such as energy and government that could provide valuable intelligence for national security, economic, and political purposes. Their targeting profile suggests a calculated approach, selecting victims based on their potential to yield sensitive information or disrupt critical infrastructure. Typical victims include organizations within the energy sector, government institutions, and entities involved in critical infrastructure, reflecting the group's intent to gather intelligence that supports Iranian geopolitical goals.

Enhanced Description

OilRig's operations are characterized by a blend of traditional cyber espionage techniques and more innovative tactics, such as exploiting trust relationships within supply chains. This approach allows them to bypass conventional security measures, potentially gaining access to sensitive information and systems that would be difficult to reach through direct attack. By analyzing the group's activities and tactics, it becomes clear that their primary goal is to gather strategic intelligence that could benefit Iranian national interests, whether through economic, political, or military means.

Key Capabilities

Supply chain attacks
Social engineering
Network exploitation
Malware development
C2 communications over various protocols

MITRE ATT&CK Tactics

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

ATT&CK Techniques

T1059.003

T1055

T1566.001

Software / Tooling

Custom malware

Exploit kits

Social engineering tools

Campaigns & Victims

OilRig's campaign patterns indicate a sophisticated and patient approach, often involving extensive reconnaissance and planning before executing an attack. Their operational tempo is characterized by a blend of high-profile, targeted operations and lower-level, opportunistic attacks, suggesting a flexible and adaptive strategy. Notable past operations have included large-scale phishing campaigns, targeted attacks against energy and government sectors, and the use of supply chain attacks to compromise intended victims. The group's ability to maintain a low profile and adapt to changing security landscapes underscores their professionalism and dedication to their objectives.

IOC Patterns

Spear-phishing with malicious attachments or links
Use of proxy servers for C2 communications
Exploitation of known vulnerabilities in software
Unusual DNS query patterns

Recommended Actions

Implement robust email filtering and security awareness training
Regularly update and patch software vulnerabilities
Monitor network traffic for suspicious patterns
Enhance supply chain security through vendor risk assessments and security audits

Suggested Tags

APT

espionage

nation-state

supply chain attack

Confidence Assessment

The confidence level in the available data on OilRig is moderate to high, given the extensive documentation by reputable cybersecurity firms and the consistency of their observed tactics and targeting. However, information gaps exist regarding the full extent of their capabilities, the specifics of their organizational structure, and the complete list of their past operations. Further research and intelligence gathering are necessary to fully understand the scope and potential of this threat actor.

ATT&CK Techniques

Collection

6 techniques

T1005

Data from Local System

OilRig has used PowerShell to upload files from compromised systems.(Citation: Trend Micro Earth Simnavaz October 2024)

T1025

Data from Removable Media

OilRig has used Wireshark’s usbcapcmd utility to capture USB traffic.(Citation: Symantec Crambus OCT 2023)

T1056.001

Keylogging

OilRig has employed keyloggers including KEYPUNCH and LONGWATCH.(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT34 July 2019)(Citation: Symantec Crambus OCT 2023)

T1113

Screen Capture

OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.(Citation: FireEye APT34 Webinar Dec 2017)

T1115

Clipboard Data

OilRig has used infostealer tools to copy clipboard data.(Citation: Symantec Crambus OCT 2023)

T1119

Automated Collection

OilRig has used automated collection.(Citation: Unit42 OilRig Playbook 2023)

Command & Control

7 techniques

T1008

Fallback Channels

OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.(Citation: OilRig ISMAgent July 2017)

T1071.001

Web Protocols

OilRig has used HTTP for C2.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT34 July 2019)

T1071.004

DNS

OilRig has used DNS for C2 including the publicly available <code>requestbin.net</code> tunneling service.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT34 July 2019)(Citation: Check Point APT34 April 2021)

T1105

Ingress Tool Transfer

OilRig had downloaded remote files onto victim infrastructure.(Citation: FireEye APT34 Dec 2017)(Citation: Trend Micro Earth Simnavaz October 2024)

T1219

Remote Access Tools

OilRig has incorporated remote monitoring and management (RMM) tools into their operations including ngrok.(Citation: Trend Micro Earth Simnavaz October 2024)

T1572

Protocol Tunneling

OilRig has used the Plink utility and other tools to create tunnels to C2 servers.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT34 July 2019)(Citation: Symantec Crambus OCT 2023)

T1573.002

Asymmetric Cryptography

OilRig used the PowerExchange utility and other tools to create tunnels to C2 servers.(Citation: FireEye APT34 Webinar Dec 2017)

Credential Access

8 techniques

T1003.001

LSASS Memory

OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT35 2018)(Citation: FireEye APT34 July 2019)

T1003.004

LSA Secrets

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT35 2018)(Citation: FireEye APT34 July 2019)

T1003.005

Cached Domain Credentials

T1110

Brute Force

OilRig has used brute force techniques to obtain credentials.(Citation: FireEye APT34 Webinar Dec 2017)(Citation: IBM ZeroCleare Wiper December 2019)

T1552.001

Credentials In Files

T1555

Credentials from Password Stores

T1555.003

Credentials from Web Browsers

T1555.004

Windows Credential Manager

OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.(Citation: FireEye APT34 July 2019)

Defense impairment

4 techniques

T1112

Modify Registry

OilRig has used reg.exe to modify system configuration.(Citation: Symantec Crambus OCT 2023)(Citation: Trend Micro Earth Simnavaz October 2024)

T1553.002

Code Signing

OilRig has signed its malware with stolen certificates.(Citation: ClearSky OilRig Jan 2017)

T1556.002

Password Filter DLL

OilRig has registered a password filter DLL in order to drop malware.(Citation: Trend Micro Earth Simnavaz October 2024)

T1686.003

Windows Host Firewall

OilRig has modified Windows firewall rules to enable remote access.(Citation: Symantec Crambus OCT 2023)

Discovery

14 techniques

T1007

System Service Discovery

OilRig has used <code>sc query</code> on a victim to gather information about services.(Citation: Palo Alto OilRig May 2016)

T1012

Query Registry

OilRig has used <code>reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default”</code> on a victim to query the Registry.(Citation: Palo Alto OilRig May 2016)

T1016

System Network Configuration Discovery

OilRig has run <code>ipconfig /all</code> on a victim.(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)

T1033

System Owner/User Discovery

OilRig has run <code>whoami</code> on a victim.(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)(Citation: Check Point APT34 April 2021)

T1046

Network Service Discovery

OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.(Citation: FireEye APT34 Webinar Dec 2017)

T1049

System Network Connections Discovery

OilRig has used <code>netstat -an</code> on a victim to get a listing of network connections.(Citation: Palo Alto OilRig May 2016)

T1057

Process Discovery

OilRig has run <code>tasklist</code> on a victim's machine and used infostealers to capture processes.(Citation: Palo Alto OilRig May 2016)(Citation: Symantec Crambus OCT 2023)

T1069.001

Local Groups

OilRig has used <code>net localgroup administrators</code> to find local administrators on compromised systems.(Citation: Palo Alto OilRig May 2016)(Citation: Symantec Crambus OCT 2023)

T1069.002

Domain Groups

OilRig has used <code>net group /domain</code>, <code>net group “domain admins” /domain</code>, and <code>net group “Exchange Trusted Subsystem” /domain</code> to find domain group permission settings.(Citation: Palo Alto OilRig May 2016)

T1082

System Information Discovery

OilRig has run <code>hostname</code> and <code>systeminfo</code> on a victim.(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)(Citation: FireEye APT34 July 2019)(Citation: Check Point APT34 April 2021)(Citation: Symantec Crambus OCT 2023)

T1087.001

Local Account

OilRig has run <code>net user</code>, <code>net user /domain</code>, <code>net group “domain admins” /domain</code>, and <code>net group “Exchange Trusted Subsystem” /domain</code> to get account listings on a victim.(Citation: Palo Alto OilRig May 2016)

T1087.002

Domain Account

T1120

Peripheral Device Discovery

OilRig has used tools to identify if a mouse is connected to a targeted system.(Citation: Check Point APT34 April 2021)

T1201

Password Policy Discovery

OilRig has used net.exe in a script with <code>net accounts /domain</code> to find the password policy of a domain.(Citation: FireEye Targeted Attacks Middle East Banks)

Execution

9 techniques

T1047

Windows Management Instrumentation

OilRig has used WMI for execution.(Citation: FireEye APT34 Webinar Dec 2017)(Citation: Symantec Crambus OCT 2023)

T1053.005

Scheduled Task

OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: FireEye APT34 July 2019)(Citation: Check Point APT34 April 2021)

T1059

Command and Scripting Interpreter

OilRig has used various types of scripting for execution.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig ISMAgent July 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit42 OilRig Nov 2018)

T1059.001

PowerShell

OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig New Delivery Oct 2017)(Citation: Crowdstrike Helix Kitten Nov 2018)(Citation: Trend Micro Earth Simnavaz October 2024)

T1059.003

Windows Command Shell

OilRig has used macros to deliver malware such as QUADAGENT and OopsIE.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig ISMAgent July 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit42 OilRig Nov 2018) OilRig has used batch scripts.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig ISMAgent July 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit42 OilRig Nov 2018)

T1059.005

Visual Basic

OilRig has used VBScript macros for execution on compromised hosts.(Citation: Check Point APT34 April 2021)

T1203

Exploitation for Client Execution

OilRig has exploited CVE-2024-30088 to run arbitrary code in the context of `SYSTEM`.(Citation: Trend Micro Earth Simnavaz October 2024)

T1204.001

Malicious Link

OilRig has delivered malicious links to achieve execution on the target system.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Crowdstrike Helix Kitten Nov 2018)(Citation: ClearSky OilRig Jan 2017)

T1204.002

Malicious File

OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Crowdstrike Helix Kitten Nov 2018)(Citation: Check Point APT34 April 2021)(Citation: ClearSky OilRig Jan 2017)

Exfiltration

1 technique

T1048.003

Exfiltration Over Unencrypted Non-C2 Protocol

OilRig has exfiltrated data via Microsoft Exchange and over FTP separately from its primary C2 channel over DNS.(Citation: Palo Alto OilRig Oct 2016)(Citation: Trend Micro Earth Simnavaz October 2024)

Initial Access

4 techniques

T1195

Supply Chain Compromise

OilRig has leveraged compromised organizations to conduct supply chain attacks on government entities.(Citation: Trend Micro Earth Simnavaz October 2024)

T1566.001

Spearphishing Attachment

OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Crowdstrike Helix Kitten Nov 2018)(Citation: ClearSky OilRig Jan 2017)

T1566.002

Spearphishing Link

OilRig has sent spearphising emails with malicious links to potential victims.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: ClearSky OilRig Jan 2017)

T1566.003

Spearphishing via Service

OilRig has used LinkedIn to send spearphishing links.(Citation: FireEye APT34 July 2019)

Lateral Movement

2 techniques

T1021.001

Remote Desktop Protocol

OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: Symantec Crambus OCT 2023)(Citation: Symantec Crambus OCT 2023)

T1021.004

SSH

OilRig has used Putty to access compromised systems.(Citation: Unit42 OilRig Playbook 2023)

Persistence

4 techniques

T1133

External Remote Services

OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.(Citation: FireEye APT34 Webinar Dec 2017)

T1137.004

Outlook Home Page

OilRig has abused the Outlook Home Page feature for persistence. OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.(Citation: FireEye Outlook Dec 2019)

T1505.003

Web Shell

OilRig has used web shells, often to maintain access to a victim network.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: Trend Micro Earth Simnavaz October 2024)

T1543.003

Windows Service

OilRig has used a compromised Domain Controller to create a service on a remote host.(Citation: Symantec Crambus OCT 2023)

Privilege Escalation

1 technique

T1068

Exploitation for Privilege Escalation

OilRig has exploited the Windows Kernel Elevation of Privilege vulnerability, CVE-2024-30088.(Citation: Trend Micro Earth Simnavaz October 2024)

Resource Development

6 techniques

T1583.001

Domains

OilRig has set up fake VPN portals, conference sign ups, and job application websites to target victims.(Citation: ClearSky OilRig Jan 2017)

T1586.002

Email Accounts

OilRig has compromised email accounts to send phishing emails.(Citation: ClearSky OilRig Jan 2017)

T1587.001

Malware

OilRig actively developed and used a series of downloaders during 2022.(Citation: ESET OilRig Downloaders DEC 2023)

T1588.002

Tool

OilRig has made use of the publicly available tools including Plink and Mimikatz.(Citation: Symantec Crambus OCT 2023)(Citation: Trend Micro Earth Simnavaz October 2024)

T1588.003

Code Signing Certificates

OilRig has obtained stolen code signing certificates to digitally sign malware.(Citation: ClearSky OilRig Jan 2017)

T1608.001

Upload Malware

OilRig has hosted malware on fake websites designed to target specific audiences.(Citation: ClearSky OilRig Jan 2017)

Stealth

10 techniques

T1027.005

Indicator Removal from Tools

OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.(Citation: Palo Alto OilRig April 2017)(Citation: Unit42 OilRig Nov 2018)

T1027.013

Encrypted/Encoded File

OilRig has encrypted and encoded data in its malware, including by using base64.(Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit42 OilRig Playbook 2023)(Citation: Crowdstrike Helix Kitten Nov 2018)(Citation: Unit42 OilRig Nov 2018)

T1036

Masquerading

OilRig has used .doc file extensions to mask malicious executables.(Citation: Check Point APT34 April 2021)

T1036.005

Match Legitimate Resource Name or Location

OilRig has named a downloaded copy of the Plink tunneling utility as \ProgramData\Adobe.exe.(Citation: Symantec Crambus OCT 2023)

T1070.004

File Deletion

OilRig has deleted files associated with their payload after execution.(Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 OopsIE! Feb 2018)

T1078

Valid Accounts

OilRig has used compromised credentials to access other systems on a victim network.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: IBM ZeroCleare Wiper December 2019)

T1078.002

Domain Accounts

OilRig has used an exfiltration tool named STEALHOOK to retreive valid domain credentials.(Citation: Trend Micro Earth Simnavaz October 2024)

T1140

Deobfuscate/Decode Files or Information

A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig New Delivery Oct 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Crowdstrike GTR2020 Mar 2020)

T1218.001

Compiled HTML File

OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.(Citation: Palo Alto OilRig May 2016)

T1497.001

System Checks

OilRig has used macros to verify if a mouse is connected to a compromised machine.(Citation: Check Point APT34 April 2021)

Software / Tooling

win.alma_communicator

Alma Communicator

Family

S0360

BONDUPDATER

Family

(Citation: FireEye APT34 Dec 2017) (Citation: Palo Alto OilRig Sep 2018)

Clayslide

DarkSeaGreenShell

ELVENDOOR

S0170

Helminth

Family

(Citation: Palo Alto OilRig May 2016)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: Crowdstrike Helix Kitten Nov 2018)

ISMDoor

ISMInjector

(Citation: OilRig New Delivery Oct 2017)

Invoke-Obfuscation

LittleFace)

S1169

Mango

Family

(Citation: ESET OilRig Campaigns Sep 2023)

S1170

ODAgent

Family

(Citation: ESET OilRig Downloaders DEC 2023)

S1172

OilBooster

Family

(Citation: ESET OilRig Downloaders DEC 2023)

S1171

OilCheck

Family

(Citation: ESET OilRig Downloaders DEC 2023)

S0264

OopsIE

Family

(Citation: Unit 42 OopsIE! Feb 2018)

POWBAT

POWRUNER

POWRUNER

(Citation: FireEye APT34 Dec 2017)

S1173

PowerExchange

Family

(Citation: Symantec Crambus OCT 2023)

S0029

PsExec

PupyRAT

S0269

QUADAGENT

Family

(Citation: Unit 42 QUADAGENT July 2018)

S0495

RDAT

Family

(Citation: Unit42 RDAT July 2020)

S0258

RGDoor

Family

(Citation: Unit 42 RGDoor Jan 2018)

S0185

SEASHARPEE

Family

(Citation: FireEye APT34 Webinar Dec 2017)

SSH Tunnels to Windows Servers

S1168

SampleCheck5000

Family

(Citation: ESET OilRig Campaigns Sep 2023)

S0610

SideTwist

Family

(Citation: Check Point APT34 April 2021)

S1166

Solar

Family

(Citation: ESET OilRig Campaigns Sep 2023)

TinyZBot

Webshells (TwoFace

ZeroCleare

OilRig collaborated on the destructive portion of the ZeroCleare attack.(Citation: IBM ZeroCleare Wiper December 2019)

customized Mimikatz

malicious RTF files CVE-2017-0199 and CVE-2017-11882

plink

Campaigns / Victims

All campaigns →

Active

Cleaver

TLP:CLEAR

Observed Data

No observed data linked yet.

Indicators of Compromise

View all →

Domain 18 URL 2

Domain 18

hospitalinstallation.com

75% TLP:CLEAR

google.com.hospitalinstallation.com

75% TLP:CLEAR

hygienehistory.com

75% TLP:CLEAR

adserviceupdate.com

75% TLP:CLEAR

auth.hospitalinstallation.com

dubai-8.vaermb.com

dubai-9.vaermb.com

email.taxoman.gov.om

mail.rfo.gov.om

mersaltest.mjla.gov.om

75% TLP:CLEAR

myjitsi.exceptionnotfound.ir

75% TLP:CLEAR

myjitsi.mrnajafipour.ir

75% TLP:CLEAR

price.exceptionnotfound.ir

75% TLP:CLEAR

s5.sideliner.ir

75% TLP:CLEAR

shop.exceptionnotfound.ir

75% TLP:CLEAR

tools.exceptionnotfound.ir

75% TLP:CLEAR

mjla.gov.om

75% TLP:CLEAR

identificara.com

75% TLP:CLEAR

URL 2

https://adserviceupdate.com/cac.aspx

75% TLP:CLEAR

https://hygienehistory.com/cac.aspx

75% TLP:CLEAR

Open in full Indicators list →

References

Check Point APT34 April 2021 — Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.
ClearSky OilRig Jan 2017 — ClearSky Cybersecurity. (2017, January 5). Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford. Retrieved May 3, 2017.
Trend Micro Earth Simnavaz October 2024 — Fahmy, M. et al. (2024, October 11). Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East. Retrieved November 27, 2024.
Palo Alto OilRig May 2016 — Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
Palo Alto OilRig April 2017 — Falcone, R.. (2017, April 27). OilRig Actors Provide a Glimpse into Development and Testing Efforts. Retrieved May 3, 2017.
Palo Alto OilRig Oct 2016 — Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.
IBM ZeroCleare Wiper December 2019 — Kessem, L. (2019, December 4). New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East. Retrieved September 4, 2024.
Unit 42 QUADAGENT July 2018 — Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.
Crowdstrike Helix Kitten Nov 2018 — Meyers, A. (2018, November 27). Meet CrowdStrike’s Adversary of the Month for November: HELIX KITTEN. Retrieved December 18, 2018.
Microsoft Threat Actor Naming July 2023 — Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
Proofpoint Iranian Aligned Attacks JAN 2020 — Proofpoint. (2020, January 10). Iranian State-Sponsored and Aligned Attacks: What You Need to Know and Steps to Protect Yourself. Retrieved January 16, 2025.
FireEye APT34 Dec 2017 — Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
Secureworks COBALT GYPSY Threat Profile — Secureworks. (n.d.). COBALT GYPSY Threat Profile. Retrieved April 14, 2021.
Symantec Crambus OCT 2023 — Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.
Unit 42 Playbook Dec 2017 — Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
Unit42 OilRig Playbook 2023 — Unit42. (2016, May 1). Evasive Serpens Unit 42 Playbook Viewer. Retrieved February 6, 2023.

Intel Summary

Techniques

Tools

Campaigns

IOCs

Observed Data

Tactics

Details

MITRE ID: G0049
Type: Unknown
Resource Level: Government
Primary Motivation: Espionage
Country of Origin: Iran (IR)
Confidence: 90%
Added: May 2, 2026
STIX ID: intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.