chrysene

Executive Summary

Chrysene—also known as OilRig (APT34) and several other aliases—is a sophisticated Iranian state-sponsored threat group active since at least 2014. It focuses on espionage against financial, governmental, energy and industrial control sectors across the Middle East and the United States, while also deploying destructive wiper malware such as DistTrack. The group uses highly polished delivery techniques—including spear‑phishing with malicious Office attachments, stolen code‑signing certificates and supply‑chain compromises—to gain initial footholds before persisting and exfiltrating data.

Goals & Targeting

Chrysene’s strategic objectives appear two‑fold: first, the long‐term acquisition of politically or economically valuable information from governments, financial institutions, nuclear facilities and critical infrastructure; second, intermittent destructive campaigns that undermine key sector operations and create bargaining leverage. The targeting focus on Middle Eastern entities coupled with attacks on U.S. corporate and financial targets suggests a regional agenda aligned with Iranian geopolitical interests. The actor’s broad victim portfolio—including government agencies, banks, energy firms, defense contractors, universities, NGOs, and entertainment companies—reflects an opportunistic threat model that adapts to available high‑value data flows rather than strictly adhering to a single industry. Operationally Chrysene maintains persistence over months or years in compromised environments; it frequently harvests credentials for lateral movement or exfiltration and occasionally leverages compromised third‑party platforms via supply‑chain infiltration.

Key Capabilities

• Supply chain attacks
• Spear‑phishing with malicious attachments
• Targeted reconnaissance of financial/government institutions
• Custom backdoor development (ISMAgent, Agent Injector)
• IIS web‑server backdoors (RGDoor)
• Use of stolen code‑signing certificates for digitally signed malware
• Exploitation of software vulnerabilities (CVE‑2017-11882, CVE‑2024‑30088)
• Credential harvesting via account enumeration and credential dump tools (Mimikatz, LaZagne)
• Fake VPN portals and luring websites
• Communication via Microsoft Exchange Web Services API over HTTP
• VBScript/PowerShell macro delivery
• Base64 encoding with certutil decoding
• DNS tunneling fallback for C2
• Outlook Home Page persistence abuse
• Scheduled task creation (VBScript)
• Web shell deployment
• CHM loader usage
• Lateral movement using stolen credentials

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Chrysene’s campaign patterns are characterized by slow‑burn, multi‑stage operations that exploit the same delivery channels over successive years. The actor frequently uses supply chain compromise as an initial foothold—delivering malicious documents or web‑server backdoors that allow long‑term persistence—and then expands lateral reach through stolen credentials and native Windows tooling. Victim types range from high‑value government agencies and financial institutions in the Middle East to U.S. defense contractors and energy utilities, suggesting a focus on both geopolitical intelligence gathering and industrial sabotage. Notable past operations include the 2016 Clayslide spear‑phishing campaigns against Iraqi banks, the 2020 DistTrack wiper attacks that crippled power grid controllers in Jordan, and the newer .NET Native C2 channel that exchanges Outlook calendar commands via Microsoft Graph API. These campaigns consistently demonstrate Chrysene’s ability to blend sophisticated social engineering with advanced malware development. The actor’s operational tempo appears episodic: periods of intense activity (e.g., 2019–2020) are followed by quieter phases, possibly reflecting resource reallocation or shifts in strategic objectives. Nonetheless, the persistence of technical capabilities and recurring supply‑chain strategies indicates a well‑resourced, state‑backed entity.

IOC Patterns

• Malicious email attachment Digitally signed malware with stolen code‑signing certificate Phishing website (fake VPN portal) Exploiting CVE-2017-11882 in Microsoft Office IIS backdoor deployed on web servers Clayslide delivery document with embedded payload Use of Microsoft Exchange Web Services API for command & control VBScript POST requests to C2 Macro-based delivery (VBScript+PowerShell) Base64 encoding of files DNS tunneling fallback for C2 Outlook Home Page persistence abuse Scheduled VBScript task execution Web shell usage on compromised servers Fake websites hosting malware CHM loader payload

Recommended Actions

• Implement robust email filtering and attachment scanning to block spear‑phishing campaigns. Validate integrity of downloaded files against trusted certificates and detect use of stolen certs. Apply timely patches for Microsoft Office (e.g., CVE-2017-11882) and Windows (e.g., CVE-2024-30088). Block known malicious URLs/domains that host counterfeit VPN portals or fake websites. Monitor network traffic for ISMAgent/ISMInjector activity and anomalous outbound connections. Enforce web application security monitoring to detect unauthorized IIS backdoors. Strictly control authentication, monitor suspicious net user/domain enumeration. Deploy advanced phishing protection solutions to block malicious attachments. Vet third‑party software and harden supply‑chain defenses. Track Microsoft Exchange Web Services API traffic for potential C2. Block execution of VBS scripts that POST outbound requests. Restrict or monitor macro‐enabled document execution. Detect and remediate web shells on compromised servers. Harden Outlook Home Page settings to disable persistence features. Monitor DNS traffic for tunneling activity. Verify authenticity of code‑signing certificates used by malware.