OilRig
OilRig is a Middle East-based threat group with suspected ties to the Iranian government. Known aliases in the provided content include APT34, Helix Kitten, Cobalt Gypsy, Crambus, Earth Simnavaz, Europium, Evasive Serpens, Hazel Sandstorm, IRN2, ITG13, and TA452. The group has targeted organizations in the aerospace, chemical, energy, financial, government, telecommunications, and transportation sectors. Reported initial access methods in the provided content include social engineering, stolen credentials, supply chain attacks, and phishing attachments. The content describes OilRig as having a preference for PowerShell-based tooling and documents use of living-off-the-land techniques. Specifically, OilRig/APT34 has been reported using Regsvr32 to execute remote COM scripts, Certutil.exe to download payloads, and PowerShell for execution. The group has delivered macro-enabled documents that required users to enable content to run the payload. The content also states that OilRig used a compromised Domain Controller to create a service on a remote host. The provided material also attributes Poison Frog and its updated version Glimpse to OilRig. Poison Frog is described as a PowerShell and sometimes .NET backdoor first observed in 2017 and used at least through 2019. It used DNS as its primary command-and-control channel and supported basic download, upload, and execute functionality. The content further references prior reporting that Turla compromised OilRig servers and used them in operations against some of OilRig victims, and separately notes that Turla used malware obtained after compromising other threat actors, including OilRig.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
59 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
52 malware families attributed to this actor across reporting.
47 additional families tracked in Mallory.
Associated vulnerabilities
12 CVEs this actor has used in observed campaigns. 12 of them exploited in the wild.
OilRig has exploited CVE-2024-30088 to run arbitrary code in the context of SYSTEM .
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
we did produce two reports revolving around the use of a zero-day exploit (CVE-2017-0199). The most notable involved an actor we refer to as BlackOasis and their usage of the exploit in-the-wild prior to its discovery.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
7 more CVEs tied to this actor tracked in Mallory.
Observables
201 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a prior example of DNS-over-HTTPS-based command-and-control abuse.
Listed as an associated threat actor in the detection annotation for exploitation of the public-facing PTC Windchill vulnerability CVE-2026-4681.
Used DNS tunneling to map internal networks prior to escalating the attack.
Listed in the detection annotations as a threat actor associated with this analytic context.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.