OilRig
Also known as: APT34, Helix Kitten, COBALT GYPSY, Hazel Sandstorm, Crambus, EUROPIUM
OilRig targets Middle Eastern organisations and is known for abusing trust relationships between organisations, custom backdoors, and command and control over DNS. Its tooling was itself reused by another state group: MITRE reports that Turla used malware obtained after compromising OilRig.
- Public attribution
- Assessed by MITRE ATT&CK and security vendors as a suspected Iranian group working on behalf of the Iranian government.
- Active since
- Around 2014
- Targets
- Financial, government, energy, chemical and telecommunications sectors
- Organisations in the Middle East and beyond
Notable campaigns
2016 onwardMiddle East phishing campaigns
Unit 42 has tracked the group's malicious documents and backdoors since May 2016.
Signature ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1071.004Application Layer Protocol: DNS
- T1572Protocol Tunneling
- T1505.003Server Software Component: Web Shell
- T1056.001Input Capture: Keylogging
- T1110Brute Force
- T1003.001OS Credential Dumping: LSASS Memory
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Force internal clients to use your own DNS resolvers and inspect DNS for tunnelling (long, high-entropy subdomains, high query volume).
- Monitor Exchange and IIS servers for web shells.
- Limit trust between partner organisations and monitor partner-originated access.
- Use MFA and lockout policies against brute forcing.