OilRig
- First seen
- 2015-10-01 00:00:00
- Malware type
- rat, spyware
- Family
- Malware family
- Last IoC activity
- 2026-07-15 16:45:04
- Profile updated
- 2026-07-07 14:38:47
Targeted industries: government-and-public-sector financial-services energy-and-utilities technology-and-telecommunications
Targeted regions: country_code:sa country_code:ae country_code:us country_code:il
Context
OilRig is an advanced persistent threat group known for targeting organizations in the Middle East, primarily focusing on sectors like government, financial services, and energy. The group uses various malware components to infiltrate networks, exfiltrate data, and conduct espionage operations.
Detection coverage
- 9 YARA rules
Used by threat actors
- Juicy Mix (campaign)
- Outer Space (campaign)
Detection rules
- SEKOIA_Apt_Oilrig_Clipog_Strings (yara-rule)
- SEKOIA_Apt_Oilrig_Saitama_Backdoor_May2022 (yara-rule)
- SEKOIA_Apt_Oilrig_Odagent_Strings (yara-rule)
- SEKOIA_Apt_Oilrig_Sc5Kv3_Strings (yara-rule)
- SEKOIA_Apt_Oilrig_Maliciousdocument_May2022 (yara-rule)
- SEKOIA_Apt_Oilrig_Powerexchange (yara-rule)
- SEKOIA_Apt_Oilrig_Saitama_Backdoor_May2022_2 (yara-rule)
- SEKOIA_Apt_Oilrig_Oilbooster_Strings (yara-rule)
- SEKOIA_Apt_Oilrig_Webshell (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Ps1.Oilrig (report)
- twitter.com — 1074820959784321026 (report)
- threatpost.com — 157646 (report)
- vkremez.com — Investigating Iranian Threat Group (report)