Loading malware…
Helminth is a Windows backdoor associated with the Iranian-aligned OilRig threat group, also tracked as APT34. It has been observed in targeted espionage campaigns primarily affecting organizations in the Middle East, including financial, technology, government, defense, education, and related sectors, with later activity also tied to targeting outside the region. Helminth has appeared in multiple forms, including script-based variants built from VBScript and PowerShell and a standalone Windows executable variant.
Helminth is used to establish an initial foothold and provide remote control of compromised systems. Its script-based form has been delivered through malicious Office documents, including Excel macro lures and fileless Word exploit chains leveraging CVE-2017-0199. Campaigns using ClaySlide delivery documents installed Helminth through spearphishing attachments, while other operations used themed lures such as job offers, technical support themes, and spoofed academic websites. The malware has also been linked to executable delivery via a separate installer tracked as HerHer.
The malware supports command-and-control over both HTTP and DNS. In HTTP mode, it has encoded data with Base64 and transmitted it in HTTP cookie fields, and some variants encrypted HTTP traffic with RC4. In DNS mode, it has used DNS tunneling, converting ASCII data to hexadecimal for transmission and reconstructing tasking delivered through DNS responses. Helminth has been used to download commands or batch scripts, execute them on the victim host, and return collected output to its operators.
Observed host functionality includes process discovery through use of Tasklist, persistence through scheduled tasks, and persistence through shortcut creation in Windows startup-related locations. The executable variant has included a keylogging module, and reporting also attributes clipboard theft and data theft capabilities to that form. Helminth has therefore served as a flexible espionage backdoor and beachhead for follow-on activity by OilRig operators.
Helminth has been repeatedly linked to broader OilRig intrusion tradecraft, including DNS tunneling, PowerShell-heavy execution chains, and post-compromise use of credential theft and webshell tooling. It is part of a wider ecosystem of OilRig malware and access tools used to maintain persistence, collect information, and support longer-term intelligence collection operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The fileless attack was delivered via Microsoft Word documents that exploited a former zero-day vulnerability in Word, CVE-2017-0199, to install a fileless attack variant of the Helminth Trojan agent. Microsoft released the patch for the vulnerability on April 11, but many organizations have not yet deployed the update. | The fileless attack was delivered via Microsoft Word documents that exploited a former zero-day vulnerability in Word, CVE-2017-0199, to install a fileless attack variant of the Helminth Trojan agent.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...the adversary uses the ClaySlide documents to deliver Helminth, which is then used as an initial landing point or beachhead into the target’s network.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
The OilRig hackers pushed those espionage tools over two fake Oxford University pages... Both encouraged visitors to download documents... Once clicked, the crew's malware, named Helminth, would run.
In recent OilRig attacks, the threat actors purport to be legitimate service providers offering service and technical troubleshooting as a social engineering theme in their spear-phishing attacks. Earlier OilRig attacks appear to use fake job offers as a social engineering theme.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
The goal of the script is to: Download bat script Execute it and upload the results back to the C&C
The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'
Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
We speculate that the executable variant involves threat actors socially engineering the victim into running the payload, rather than installing the payload as the result of successful exploitation of a vulnerability. | This is an attempt to trick the user into running the embedded macro to install the Trojan, which does not require any vulnerability exploitation.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
Once clicked, the crew's malware, named Helminth, would run, allowing the OilRig crew to control targets’ PCs and steal data.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
The PowerShell script has similar capabilities to the VBScript, but instead of using HTTP for communications it uses a series of DNS queries to send and receive data from the server.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.
41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
54 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom backdoor used in cyberespionage operations; part of OilRig’s modular tooling for persistence and remote access.
Backdoor malware used by OilRig for persistence and remote access.
A fileless Trojan/backdoor used in the OilRig-linked campaign against Israeli organizations. It is installed via malicious Word documents exploiting CVE-2017-0199, uses PowerShell and VBS components, establishes persistence via scheduled tasks, communicates with C2 over HTTP and DNS, downloads batch scripts for execution, uploads results, and clears traces.
One variant consists of VBScript scripts.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.