OilRig

MITRE ATT&CK: G0049 View on attack.mitre.org

Aliases: COBALT GYPSY, IRN2, APT34, Helix Kitten, Evasive Serpens, Hazel Sandstorm, EUROPIUM, ITG13, Earth Simnavaz, Crambus, TA452, Twisted Kitten, Cobalt Gypsy, APT 34, ATK40, OilRig, HELIX KITTEN

First seen
2014-01-01 00:00:00
Origin
IR
Primary motivation
espionage
Sophistication
advanced
Resource level
government
Actor type
Espionage
Related IoCs
112 (103 malicious)
Last IoC activity
2026-10-18 01:52:46
Profile updated
2026-07-07 12:33:05

Targeted industries: financial-services government-and-public-sector energy-and-utilities technology-and-telecommunications

Targeted regions: country_code:ae country_code:sa country_code:qa country_code:us

Context

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.

Recent IoC activity

103 malicious indicators in Maltiverse are attributed to OilRig (G0049). The 20 most recently updated:

TypeIndicatorUpdatedSources
hostname fuschia-rhinestone.cleverapps.io 2026-10-17 1
hostname msn-service.co 2026-10-17 1
hostname twittsupport.com 2026-10-17 2
hostname maill-support.com 2026-10-17 1
hostname mail-updateservice.info 2026-10-17 2
hostname mailupdate.info 2026-10-17 1
hostname astrazencea.com 2026-10-17 1
hostname microsoft.updatemeltdownkb7234.com 2026-10-17 2
file sample 737cb075ba0b5ed6d8901dcd798eecff0bc8585091bc232c54f92df7f9e9e817 2026-10-15 1
hostname cfunc.save 2026-10-12 1
hostname deersharpfork.info 2026-10-03 1
hostname subinfralab.info 2026-10-03 1
file sample 3e1ed006e120a1afaa49f93b4156a992f8d799b1888ca6202c1098862323c308 2026-09-21 1
hostname codewizard.ml 2026-09-18 1
file sample 4fcde8ec5983cf1465ff7dbcd7d90fcd47d666b0b8352db1dcd311084ed1b3e8 2026-09-18 1
file sample bounty-75588024838477202 2026-09-18 2
file sample e5016dfeae584de20a90f1bef073c862028f410d5b0ae4c074a696b8f8528037 2026-09-18 1
file sample 62d0b8b5d4281ce107c43d36f222680b0cc85844b8973b645095ccdfb128454d 2026-09-18 1
file sample bc8f075c1b3fa54f1d9f4ac622258f3e8a484714521d89aa170246ce04701441 2026-09-18 1
file sample bdb2a12f2f84c3742240b8b9e1d6638a73c6b8752aff476051fe33a0bb408010 2026-09-18 1

Detection coverage

  • 20 YARA rules
  • 980 Sigma rules

Malware & tools used

  • Windows Credential Manager (attack-pattern)
  • System Information Discovery (attack-pattern)
  • LSASS Memory (attack-pattern)
  • Fallback Channels (attack-pattern)
  • Web Protocols (attack-pattern)
  • Data from Local System (attack-pattern)
  • Windows Host Firewall (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Remote Desktop Protocol (attack-pattern)
  • Web Shell (attack-pattern)
  • Malware (attack-pattern)
  • Upload Malware (attack-pattern)
  • Masquerading (attack-pattern)
  • Remote Access Tools (attack-pattern)
  • Compiled HTML File (attack-pattern)
  • Network Service Discovery (attack-pattern)
  • Local Account (attack-pattern)
  • Outlook Home Page (attack-pattern)
  • Domain Groups (attack-pattern)
  • Screen Capture (attack-pattern)
  • Data from Removable Media (attack-pattern)
  • System Service Discovery (attack-pattern)
  • Password Filter DLL (attack-pattern)
  • PowerShell (attack-pattern)
  • File Deletion (attack-pattern)

Related threat objects

Reports & references

  • blog.morphisec.com — Iranian Fileless Cyberattack On Israel Word Vulnerability (report)
  • Palo Alto Unit 42 — Unit42 Striking Oil Closer Look Adversary Infrastructure (report)
  • Palo Alto Unit 42 — Unit42 Introducing The Adversary Playbook First Up Oilrig (report)
  • Palo Alto Unit 42 — Unit42 Oopsie Oilrig Uses Threedollars Deliver New Trojan (report)
  • Palo Alto Unit 42 — Unit42 Oilrig Uses Rgdoor Iis Backdoor Targets Middle East (report)
  • Palo Alto Unit 42 — Unit42 Twoface Webshell Persistent Access Point Lateral Movement (report)
  • Palo Alto Unit 42 — Unit42 Oilrig Actors Provide Glimpse Development Testing Efforts (report)
  • Palo Alto Unit 42 — Unit42 Analyzing Oilrigs Ops Tempo Testing Weaponization Delivery (report)
  • Palo Alto Unit 42 — Unit42 Oilrig Malware Campaign Updates Toolset And Expands Targets (report)
  • Palo Alto Unit 42 — Unit42 Oilrig Uses Updated Bondupdater Target Middle Eastern Government (report)
  • Palo Alto Unit 42 — Unit42 Oilrig Group Steps Attacks New Delivery Documents New Injector Trojan (report)
  • Palo Alto Unit 42 — Unit42 Oilrig Targets Technology Service Provider Government Agency Quadagent (report)
  • Palo Alto Unit 42 — The Oilrig Campaign Attacks On Saudi Arabian Organizations Deliver Helminth Backdoor (report)
  • pan-unit42.github.io — Playbook Viewer (report)
  • Mandiant — Targeted Attacksaga (report)
  • Mandiant — Targeted Attack In Middle East By Apt34 (report)
  • gov.il — Cert Il Alert W 120 (report)
  • forbes.com — Oilrig Iran Hackers Cyberespionage Us Turkey Saudi Arabia (report)
  • raw.githubusercontent.com — Oilrig (report)
  • cfr.org — Oilrig (report)
  • cfr.org — Apt 34 (report)
  • CrowdStrike — Meet Crowdstrikes Adversary Of The Month For November Helix Kitten (report)
  • Broadcom/Symantec — Shamoon Destructive Threat Re Emerges New Sting Its Tail (report)
  • web.archive.org — Shamoon Attacks (report)
  • Broadcom/Symantec — Viewdocument (report)

Attributed from

  • Juicy Mix (campaign)
  • Outer Space (campaign)

External references